IBM i CVE-2026-17069

Exploitation requires a valid authenticated session with at least low-privilege credentials on the target IBM i system (confirmed by CVSS PR:L). The attack is conducted over the network (AV:N) against the IBM i web services layer where CSRF token validation is performed. No victim user interaction is required (UI:N), distinguishing this from classic browser-driven CSRF attacks. Limiting factors: an unauthenticated attacker cannot exploit this flaw; access to the IBM i web interface must be reachable from the attacker's network position; and the vulnerability is constrained to IBM i versions 7.3, 7.4, 7.5, and 7.6. Environments where IBM i web services are firewalled from untrusted networks and where low-privilege account provisioning is tightly controlled face materially reduced risk.

The CVSS 8.1 High score is driven by network-accessible attack vector (AV:N), low complexity (AC:L), low-privilege requirement (PR:L), and high confidentiality and integrity impact (C:H/I:H). No EPSS data was provided in source intelligence, limiting probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog and no POC exists per available data. The PR:L requirement is a meaningful friction point - exploitation is limited to accounts with at least some valid authentication on the IBM i system, reducing exposure compared to unauthenticated flaws. However, for environments where IBM i web services are internet-facing or accessible by a broad internal user base, a compromised low-privilege account is a realistic entry point. The absence of user interaction (UI:N) removes the social engineering dependency typical of CSRF, making this straightforward to automate once access is obtained. On balance, this is a genuine priority for IBM i shops due to the high impact rating, but the authentication barrier tempers urgency relative to unauthenticated equivalents.

An attacker with a valid low-privilege IBM i account connects to the web-facing interface of an affected IBM i system and submits a crafted request that omits or presents an invalid CSRF token, which the server incorrectly accepts. The attacker leverages this bypass to perform unauthorized state-changing operations - such as modifying configuration, accessing protected data, or altering user settings - achieving high confidentiality and integrity impact without requiring any interaction from a privileged victim. No public exploit code has been identified at time of analysis.