IBM i Service Extension: SWMA already gets you the PTFs

IBM i 7.4 loses standard support tomorrow, and IBM i 7.3’s first Service Extension expires the same day. Nearly every article written about that date says the same thing: buy IBM i Service Extension or stop getting security patches. IBM’s own planning document says otherwise, and the difference is worth real money.

Here is the short version. Active base Software Maintenance is what entitles you to download fixes, including after a release goes out of service. Service Extension is what entitles you to pick up the phone. Those are two different products, and a lot of shops are about to buy the second one believing it is the first.

What tomorrow actually changes

Nothing operational. Your partition IPLs on October 1 the way it did on September 29. No license key expires and nobody from IBM calls.

What changes is your support contract tier. From October 1, IBM i 7.4 sits in Service Extension through September 30, 2029, and IBM i 7.3 moves from its first Service Extension into an extended one running through September 30, 2028. We have already covered what that bill looks like year by year, including the full 7.4 exception table, so the pricing ladder is not the subject here. For reference, the 7.4 surcharge starts at 1.5 times base SWMA and climbs to 2.5 times by 2029, per IBM’s Service Extension document last revised February 25, 2026.

What that money buys is narrower than the vendor posts suggest.

The table IBM publishes and nobody quotes

IBM maintains a deck called IBM i Support Roadmap and Service Extension Information, last updated April 8, 2025. Page 6 carries a three-column comparison that answers the question every shop is actually asking, and not one competitor article reproduces it.

The three columns are: you hold a Service Extension contract, you hold active SWMA with no Service Extension, or you hold neither.

Can the client…	Service Extension	SWMA only	Neither
Open a case for a release under Service Extension	Yes	No	No
Report a new defect	Yes	No	No
Ask IBM about fixes for known defects on that release	Yes	No	No
Download post end-of-service fixes from Fix Central	Yes	Yes	No
Upgrade to a currently supported release at no extra charge	Yes	Yes	No

Read the fourth row twice. IBM states it again in the same document’s Q&A, in a list of what active base SWMA covers “even after the effective end-of-service date has been reached or the Service Extension has ended for a release”: “PTFs can be downloaded from FixCentral when SWMA is active, even after the effective end-of-service date has been reached for a release.”

And the fifth row, in IBM’s words: “SE is not required in order to upgrade.”

Two caveats before anyone cancels anything. The document carries a 2023 copyright and an April 2025 revision date, so it predates the 7.4 transition, and its table is written generically for “a release which is under Service Extension” rather than for 7.4 specifically. And this entire table collapses if base SWMA lapses. The right-hand column is the one where nothing works, and it is also the column a shop lands in by quietly not renewing.

What IBM i Service Extension actually buys

Strip the table down and Service Extension is an access product, not a patch product. Everything in the paid column is a conversation: open a case, report a new defect, ask about defects already on file. That is a real product with real value, and for some shops it is worth the surcharge. It is just not the product most buyers think they are getting. If your mental model was “Service Extension keeps the security patches coming,” the correct model is “Service Extension keeps you able to ask for one.”

Here is our read on the part IBM does not spell out, and it is a conclusion rather than a quote. The 7.4 Service Extension tier is typed “New Defect plus Usage and Known Defect,” which is IBM committing to fix new defects for the shops paying for it. Those fixes land on Fix Central, where an unpaid shop with active SWMA can pull them. So the paying customers are, in practice, what causes 7.4 PTFs to keep appearing at all, and everyone else rides on that. That is stable right up until the paying population thins out.

The DDM bulletin is the live test case

This stops being abstract if you look at what IBM published on September 2, 2026.

Security bulletin node 7286186 covers two vulnerabilities in Distributed Data Management and Distributed Relational Database Architecture, the protocols IBM i uses for remote database connections:

CVE-2026-18175, CVSS 8.1, improper authorization in the DDM target dispatcher. A remote attacker can manipulate database transactions. The vector carries a changed scope.
CVE-2026-18221, CVSS 8.1, improper authentication. A remote attacker gains unauthorized access through improper validation of client-supplied authentication parameters. High on confidentiality, integrity and availability.

Under “Workarounds and Mitigations,” IBM wrote one word: None.

Affected releases are 7.6, 7.5, 7.4 and 7.3. All four. And IBM published PTFs for all four: SJ11231 and SJ11230 on 7.6, SJ11232 and SJ11233 on 7.5, SJ11262 and SJ11261 on 7.4, and SJ11234 and SJ11235 on 7.3.

Those last four PTF numbers are the point. A 7.4 or 7.3 shop with active SWMA and no Service Extension contract can pull them from Fix Central today, and can still pull them next month. Nothing about tomorrow’s date locks them away. If you have not applied them, that is more urgent than any contract decision, and it deserves the same caution as the August batch that broke three things on the way in.

The disclaimer that decides whether you hear about the next one

Now the part that should actually worry you, which is not about the patch you can get. It is about the one you never learn you need.

Every IBM security bulletin ends with boilerplate nobody reads. This is the sentence that matters:

“Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.”

The same paragraph explains that the “Affected Products and Versions” table is “intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date,” and that leaving a version out “does not constitute a determination by IBM that they are unaffected by the vulnerability.”

Two consequences, and both are ours to draw:

Silence is not safety. The September 2 bulletin names 7.4 and 7.3 because on September 2 neither had passed its date. From October 1 both have. A future DDM bulletin can list 7.6 and 7.5 only, while 7.4 remains just as vulnerable. Your CVE triage process, if it works by searching bulletins for your release, will start returning clean results for the wrong reason.

Paying does not create an obligation either. Note that IBM’s disclaimer names “extended-support products or versions” explicitly. Service Extension buys the channel to report and escalate. It does not buy a contractual guarantee that a fix gets written. That is consistent with the roadmap table rather than a contradiction of it, and it is the honest framing of the purchase.

If you are on 7.3, read your own exception table

Both releases are typed the same way in IBM’s Service Extension document, but the eligible-products tables differ, and the 7.3 one is quietly worse. Three gaps nobody lists:

Access Client Solutions is not in it. The 7.4 eligible-products table includes 5733-XJ1 Access Client Solutions. The 7.3 table does not list it at all. A 7.3 shop paying a 3x surcharge has no listed ACS coverage, which matters because ACS is the software on every developer laptop that connects to the box, and it carried its own CVE cluster this summer.

IBM Toolbox for Java is downgraded. IBM’s note for 7.3 puts Toolbox for Java, accessed through jt400.jar and jt400Native.jar, at usage and known defect only, and adds that it will no longer be supported with Java 7. That jar is how a large share of Java workloads talk to Db2 for i. There is no equivalent restriction in the 7.4 notes.

BRMS and CICS were downgraded a year ago. Both 5770-BR1 and 5770-DFH show “Effective 10/01/2025: Usage & Known Defect” on 7.3. The 7.3 table also does not list 5770-BR2 at all, the subscription version that now runs $400 per core per year. The 7.4 table does list it.

The price for that narrower table is a 3x surcharge, which on IBM’s $1,000 per core example means $4,000 per core per year starting tomorrow. A 7.3 shop pays more on day one than a 7.4 shop pays in 2029. And if that 7.3 workload is on Power7 or Power7+, 7.3 is the last release those machines run, which puts you one generation deeper into the trap Power8 shops are already in.

Who should buy it, and who should not

A real answer rather than a shrug.

Buy it if a defect you cannot report would stop your business. Shops running a heavily customized ERP on 7.4 with no vendor support path, shops under a compliance regime that requires a live support contract on every production OS, and shops in the middle of a funded migration that lands inside the window. In all three, the ability to open a case is the thing you are insuring, and that is exactly what the contract sells.

Skip it if your honest answer to “what would we do with a case?” is “escalate to our business partner.” If you have never opened an IBM case on this box, a contract entitling you to open one is a line item, not risk reduction. Apply everything on Fix Central and put the difference toward the upgrade.

Do not skip base SWMA. It is the prerequisite for Service Extension, for free release-to-release upgrades, and for post-end-of-service Fix Central downloads. Letting it lapse removes every option at once, including the free ones.

What to check this week

Four things, none of which is an upgrade.

Apply the DDM PTFs. SJ11262 and SJ11261 on 7.4, SJ11234 and SJ11235 on 7.3. Two 8.1 CVEs with no workaround.
Confirm base SWMA is active and stays active. Check the renewal date, not your memory of it, because renewals from January 1 carry a 12 percent SWMA increase.
Fix your CVE triage. If your process is “search IBM bulletins for our release,” it degrades from October 1. Subscribe to My Notifications and start reading bulletins for the next release up, because a DDM defect in 7.5 almost certainly exists in 7.4.
Get the Service Extension quote anyway. It is not orderable through e-config or your normal channel, it goes through IBM Technology Lifecycle Services. Ask for all remaining years in writing, then decide against the access question rather than the patch question.

Bottom line

Service Extension is worth buying for the reason IBM actually sells it, the right to open a case and report a defect on an out-of-service release. It is not what keeps fixes flowing to your box. Active base SWMA does that, and IBM says so in a planning document that has been public for over a year.

So the decision tomorrow is narrower than “pay or run unpatched.” Are you a shop that needs to be able to report a bug on 7.4? If yes, buy it and budget the escalator. If no, keep SWMA current, stay ruthless about Fix Central, fix your CVE triage so a silent bulletin does not read as good news, and spend the difference getting off the release. The shops that get hurt by this date will not be the ones who declined the contract. They will be the ones who let SWMA lapse, or who stopped checking because nothing was listed. If nobody left in the building is confident about what that box is actually running, that is the more expensive problem.

Frequently Asked Questions

Do I need IBM i Service Extension to get security PTFs?

No, not to download ones that already exist. IBM’s own IBM i Support Roadmap document states that PTFs can be downloaded from Fix Central when SWMA is active, even after the effective end-of-service date has been reached for a release. What Service Extension adds is the right to open a case, report a new defect, and ask IBM about known ones.

How much does IBM i 7.4 Service Extension cost?

It is a surcharge on top of base SWMA, which stays a prerequisite. Year one adds 1.5 times base SWMA, year two adds 2 times, year three adds 2.5 times. On IBM’s own $1,000 per core example that is $2,500, then $3,000, then $3,500 per core per year through September 2029.

What happens to IBM i 7.3 on October 1, 2026?

Its first Service Extension expires September 30, 2026 and an extended Service Extension runs from October 1, 2026 through September 30, 2028. That tier costs 3 times base SWMA as a surcharge, so $4,000 per core per year on IBM’s $1,000 example. A 7.3 shop pays more on day one than a 7.4 shop pays in 2029.

Can I upgrade off IBM i 7.4 without buying Service Extension?

Yes. IBM’s roadmap document says plainly that Service Extension is not required in order to upgrade. With active base SWMA you can order a release-to-release upgrade through e-config or the Entitled System Support portal at no additional charge and download the newer release once your entitlement records are updated.