IBM i CVE-2026-17015

Exploitation requires the attacker to possess at minimum a low-privilege authenticated account on the target IBM i system (CVSS PR:L confirmed); unauthenticated remote exploitation is not possible per the CVSS vector. Network access to the IBM i system is required (AV:N). No user interaction beyond the attacker's own actions is needed (UI:N), and attack complexity is low (AC:L), meaning no race condition or special environmental state must be arranged. The specific IBM i subsystem, service, or protocol endpoint that is vulnerable is not disclosed in available data, which limits defenders' ability to apply targeted service-level mitigations. SSVC's non-automatable classification is consistent with the authentication prerequisite. Factors that bound exploitation: valid IBM i credentials are mandatory; no mass-exploitation automation is expected; the affected component is unspecified, so targeted exploitation likely requires some system knowledge.

The CVSS 8.1 score reflects a genuinely elevated risk profile: network-reachable (AV:N), low complexity (AC:L), no user interaction required (UI:N), with both high confidentiality (C:H) and high availability (A:H) impact. The primary limiting factor is the authentication prerequisite (PR:L), which constrains exploitation to accounts holding at least low-privilege access on the IBM i system. EPSS at 0.31% (24th percentile) indicates the broader security community assigns a low near-term exploitation probability, consistent with the authentication barrier. SSVC confirms no known exploitation and classifies the attack as non-automatable - directly aligning with the credential requirement that prevents unauthenticated mass scanning. For organizations running IBM i in high-value verticals (banking, insurance, ERP), the combination of C:H and A:H against a platform hosting critical business data and transactions elevates operational risk significantly beyond what a generic EPSS score might suggest. No KEV listing and no POC code identified; no conflicting signals between data sources are present.

An attacker holding a low-privilege IBM i user account connects over the network to a vulnerable IBM i 7.3-7.6 system and sends a specially crafted request to the affected network-facing service, triggering an out-of-bounds read in the underlying handler. The attacker reads sensitive data from memory regions adjacent to the intended buffer - potentially exposing system configuration data, credentials, or application data - and may simultaneously crash the service, disrupting business-critical workloads dependent on the IBM i platform. No public proof-of-concept code has been identified at time of analysis.