IBM i CVE-2026-17071

Exploitation strictly requires remote authentication with a high-privilege IBM i account, as confirmed by the CVSS PR:H metric. Standard user accounts and low-privilege authenticated sessions are insufficient - only users holding high system authorities (such as *ALLOBJ, *SECADM, or equivalent) can trigger the vulnerability. The description does not cite a specific non-default feature or configuration setting as a prerequisite, suggesting the vulnerable code path is reachable under normal high-privilege operation. Key limiting factors are: mandatory high-privilege authentication (PR:H per CVSS), which constrains exploitation to a small population of privileged insiders or attackers who have already achieved full credential compromise; no confidentiality or availability impact, meaning even successful exploitation yields only limited file integrity manipulation; and the specific IBM i platform requirement, which limits affected environments to organizations running IBM Power Systems with IBM i 7.3-7.6.

The CVSS 3.1 base score of 2.7 (Low) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N presents a coherent and proportionate risk picture. The network attack vector (AV:N) and low complexity (AC:L) would normally elevate concern, but the high privilege requirement (PR:H) substantially limits the realistic attacker population to insiders or those who have already fully compromised a privileged IBM i account - at which point the marginal value of path traversal for limited file manipulation is modest. No EPSS score was provided in available data, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept code has been identified. The absence of confidentiality and availability impact (C:N/A:N) further constrains blast radius. This is not a prioritization emergency - it is a patch-on-schedule issue for most organizations, with urgency elevated only in environments where privileged IBM i accounts may be shared, weakly protected, or accessible to untrusted insiders.

An attacker who has legitimately or illicitly obtained a high-privilege IBM i account (such as a *SECADM or *ALLOBJ user) authenticates remotely and submits a crafted file path containing traversal sequences to a vulnerable IBM i interface or command. The traversal sequences cause the system to resolve the path outside the intended directory, allowing the attacker to write to or overwrite files in otherwise-restricted locations. No public proof-of-concept code has been identified, and the high-privilege prerequisite makes opportunistic exploitation unlikely.