IBM i CVE-2026-17004

No special conditions are required based on the CVSS vector AV:N/AC:L/PR:N/UI:N - this represents remote unauthenticated exploitation against IBM i systems running versions 7.3, 7.4, 7.5, or 7.6 that expose the vulnerable network service. The specific network service or protocol component is not identified in available vendor disclosure, which means the precise attack surface cannot be further scoped from public data alone. Exploitation is limited by the requirement that the affected service be network-reachable from the attacker; perimeter controls blocking access to IBM i management or application ports would reduce exposure. The scope is unchanged (S:U), confirming impact is contained to the vulnerable system itself.

The CVSS 7.5 (High) score reflects a genuinely accessible threat surface: AV:N/AC:L/PR:N/UI:N means a remote, unauthenticated attacker with no special conditions can reliably trigger the fault. The A:H impact confirms full availability loss with no confidentiality or integrity compromise, consistent with a pure DoS class. No EPSS score is available in the provided intelligence, which limits probabilistic exploitation assessment. KEV status is absent, and no POC is referenced, indicating the vulnerability has not yet crossed into confirmed exploitation at scale - however, the low attack complexity means exploitation would be straightforward once a trigger is identified. IBM i platforms often run mission-critical, high-availability workloads where even brief service disruption carries significant operational cost, so organizations running any of the four affected release lines should treat patching as high priority regardless of the absence of active exploitation evidence.

An attacker sends a specially crafted network request to a vulnerable IBM i system, targeting a network-facing service susceptible to the infinite loop condition. The service enters a non-terminating loop, consuming processing resources until the component becomes unresponsive, denying service to legitimate users and applications. Because the CVSS vector requires no authentication and low complexity, this attack could be automated or scripted with minimal effort once a working trigger is identified.