Each entry below is sourced from an IBM Security Bulletin, with our own summary of what happened, why it matters, and what to do. Verified dates are shown on every entry.
IBM published a security bulletin covering five CVEs (CVE-2026-10852, CVE-2026-8858, CVE-2026-9072, CVE-2026-8633, CVE-2026-8620) affecting WebSphere Application Server Liberty as shipped on IBM i, spanning denial of service, HTTP request smuggling, and remote code execution risk.
Why It Matters
WebSphere Liberty underpins many IBM i web-facing applications and administrative interfaces (including Access Client Solutions and custom web apps). A remote code execution path on an internet-facing or lightly segmented Liberty instance is a serious exposure, not a theoretical one.
Recommended Actions
Identify every LPAR and instance running WebSphere Liberty on IBM i, including embedded/administrative uses
Match installed Liberty versions against IBM's affected-product table in the bulletin
Apply IBM's listed fix or documented mitigation on every affected instance
Re-verify externally-facing Liberty endpoints are not exposed beyond what business need requires
IBM published a security bulletin covering four CVEs (CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, CVE-2026-35388) affecting OpenSSH as shipped on IBM i, spanning permission handling, command execution, algorithm selection, and connection multiplexing weaknesses.
Why It Matters
SSH is a primary administrative and file-transfer access path on many IBM i shops that have moved off Telnet. Weaknesses in permission handling or command execution on the SSH stack directly affect the security of that access path.
Recommended Actions
Match installed OpenSSH levels against IBM's affected-product table in the bulletin
Apply the prescribed PTFs on every LPAR running SSH access
Review SSH configuration for connection multiplexing settings called out in the bulletin
Confirm no unmanaged or forgotten LPARs are still running unpatched OpenSSH
IBM released a security bulletin and firmware update addressing CVE-2026-22796, a vulnerability in the Power system service processor involving handling of a maliciously crafted digitally signed file.
Why It Matters
The service processor sits below the operating system layer. A vulnerability here has implications beyond IBM i itself and affects the hardware platform's trust boundary, so it warrants firmware-level remediation, not just an OS-level PTF.
Recommended Actions
Determine the firmware level on every Power system in scope
Schedule the IBM-released firmware update through your normal hardware maintenance window
Confirm HMC/BMC access used to apply firmware updates is itself access-controlled and MFA-protected
IBM published a security bulletin covering six CVEs (CVE-2026-22016, CVE-2026-22021, CVE-2026-22013, CVE-2026-22018, CVE-2026-34268, CVE-2026-22007) affecting the IBM Java SDK and IBM Java Runtime as shipped on IBM i.
Why It Matters
IBM Java underpins a wide range of IBM i middleware and third-party applications. Because Java versions are frequently pinned to specific application requirements, these fixes are easy to miss if version tracking is not centralized.
Recommended Actions
Inventory every installed Java version across LPARs, including versions pinned for specific applications
Apply IBM's release-specific PTFs per the bulletin's affected-product table
Coordinate with application owners before upgrading shared Java runtimes to avoid compatibility breaks