Keep Calm Security is Not Convenient
I think it is fair to say that many companies chose to run on IBM i for its reliability, its resilience, and its legendary uptime. But in 2026, the rules of engagement have changed. Doing nothing is no longer a viable option and taking a proactive approach to the IBM i operating system and the client software connected to it, is now something we all must build into our standard working practices.
The Threat Landscape Has Changed Permanently
For years, IBM i administrators often argued that their platform sat quietly in the corner, they patched it a couple of times a year and with just a few tweaks to the default configuration it became impervious to the chaos affecting other operating systems.
That argument is getting harder to make. Artificial intelligence is now routinely being used by security researchers and attackers to analyse operating system internals and surface new vulnerabilities at a pace that was simply not possible before.
The numbers reflect this new reality. At the time of writing, IBM i 7.6 carries 101 published CVEs, of which 24 are rated Critical. Before you reach for the smelling salts, consider the context: IBM i actually compares remarkably well against other enterprise platforms. Windows Server 2025 carries more than 690 CVEs by the same measure.
The IBM i number is low but it is no longer zero, and the critical ones are real. The only appropriate response is to patch them.
Applying PTFs is Only Half the Job
Here is where many IBM i shops run into trouble. They apply the operating system PTFs diligently and then discover that their client software breaks. This is not a bug. It is the system working exactly as designed; tightening security controls means that older, less secure connection methods are no longer accepted.
Two specific examples from the August 2026 CVE PTF wave illustrate this perfectly.
IBM i Access ODBC Drivers for Windows, Mac & Linux
Older versions of IBM i Access ODBC drivers use legacy authentication methods that the updated IBM i security will now reject after you installed the last PTFs. IBM has published guidance on exactly which versions are affected and what to upgrade to:
IBM Support: Security PTF enhancements can block older ACS Windows drivers
https://www.ibm.com/support/pages/security-ptf-enhancements-can-block-older-acs-windows-drivers
SMB/CIFS and NTLMv1
SMB/CIFS file sharing via IBM i NetServer is similarly affected. NetServer clients relying on NTLMv1 authentication will fail to connect after applying the latest CVE PTFs. NTLMv1 is a decades-old protocol that has no place in a modern security posture but plenty of legacy mapped drives and line-of-business applications are still quietly using it. Affected environments should update the client security policies such that they send the Message Integrity Code before applying the August 2026 PTF group.
IBM Support: SMB/CIFS clients using NTLMv1 fail to IBM i NetServer after applying latest CVE PTFs from Aug 2026
https://www.ibm.com/support/pages/smbcifs-clients-using-ntlmv1-fail-ibm-i-netserver-after-applying-latest-cve-ptfs-aug-2026
Know Your Exposure using SYSTOOLS.CVE_INFO
IBM has responded to the growing CVE workload with a genuinely useful addition to the platform: a built-in SQL table function called SYSTOOLS.CVE_INFO. This function, part of the DB2 for i SQL toolbox, allows you to query CVE exposure information for your specific system directly from a SQL session.
A simple query such as
Select * FROM SYSTOOLS.CVE_INFO
will return a list of CVEs applicable to your current OS release and PTF level, along with severity scores and remediation details. If you prefer a graphical view, the same information is obtainable in IBM Navigator for i making it accessible to administrators who would rather click than type.
IBM Support: CVE Security Vulnerability Analysis using SQL
https://www.ibm.com/support/pages/cve-security-vulnerability-analysis-using-sql
This removes the most common excuse for not knowing your patch status. The data is inside the machine you already manage. There is no reason not to look.
Know Your Exposure using Navigator for i
For those who like a GUI. the above SYSTOOLS.CVE_INFO function has been included in the Navigator for i interface.
A Practical Approach is to Patch and Prepare Together
The lesson here is not that PTFs are dangerous. The lesson is that a security programme only works when you treat the operating system and its client ecosystem as a single unit. Before every PTF group or security group application, run through this checklist:
• Query SYSTOOLS.CVE_INFO to understand what you are patching and why
• Check the IBM Support pages for the specific PTF group for known client-side impacts
• Audit ACS versions deployed to Windows workstations and update to the current release
• Audit ODBC driver versions on application servers and developer machines
• Identify any SMB/CIFS mapped drives or applications using NTLMv1 and migrate them to use MIC.
The Bottom Line
IBM i remains one of the most secure enterprise platforms available but that security is not self-maintaining. AI-assisted vulnerability research means new CVEs will continue to arrive, the bar for what counts as an acceptable authentication protocol will keep rising, and client software that has not been updated for a few years will increasingly find the door closed.
Keep calm!
Apply your PTFs. Update your clients. And start querying SYSTOOLS.CVE_INFO because the best time to know your CVE exposure is before someone else finds it for you.