# CVE-2026-77153: IBM i is Affected By Missing Authorization Vulnerability in Host-Based Printer Subsystem []

Status: published. Published: 2026-11-08. Updated: 2026-11-08.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to obtain sensitive information from the Host-Based Printer Subsystem due to no authorization check. A bad actor could use this vulnerability to print files they should not be able to access.

## Remediation

- fix: When using Access Client Solutions (ACS) to create Telnet printer sessions, version 1.1.9.15 or later must be installed for interoperability after applying the Host-Based Printer Subsystem PTFs.  Failure to update to a compatible ACS application version will result in being unable to connect via telnet for printing. The current version of the ACS application can be viewed by clicking the 'About' link under the 'Help' tab in ACS.



View each PTF's cover letter for the additional actions required prior to installation.

IBM i Release5770-SS1 
PTF Number(s)PTF Download Link(s)7.6SJ11502 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11502 7.5SJ11523 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11523 7.4SJ11524 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11524 7.3SJ11522 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11522 



IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products. (source: CNA: ibm)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: ibm) — https://www.ibm.com/support/pages/node/7294253

## Affected products and versions

- IBM / i: 7.6 (affected); 7.5 (affected); 7.4 (affected); 7.3 (affected). Source: CNA: ibm

## Severity and prioritization

- CVSS 3.1: 4.8 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L; source: CNA: ibm

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-862

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.ibm.com/support/pages/node/7294253 (CNA: ibm; vendor-advisory, patch)

## Provenance

- CNA: ibm: https://www.cve.org/CVERecord?id=CVE-2026-77153; retrieved 2026-11-08; source updated 2026-11-08

Revision: deedb0d8af737476ecbfef048fb854c8c8d9acd7c8d0b263fde7b2280c2167e6

Canonical: https://y2.dev/cve/CVE-2026-77153

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.