IBM i CVE-2026-17074

Exploitation requires an existing low-privilege authenticated session on the affected IBM i system, as confirmed by the CVSS PR:L metric - unauthenticated exploitation is not possible. High attack complexity (AC:H) further requires non-trivial preconditions beyond standard authenticated network access; the precise trigger - whether a specific configuration setting, job environment state, timing dependency, or targeted interface - is not disclosed in the available public description. The attack surface is network-accessible (AV:N), so physical or local console access is not required. Exploitation impact is strictly limited to low integrity modification (I:L) with no confidentiality or availability effect, and does not cross a security scope boundary (S:U). The high complexity requirement is the primary limiting factor for defenders to communicate: this is not a push-button exploit against default configurations.

Real-world risk is low. The CVSS base score of 3.1 is structurally supported by meaningful mitigating factors: high attack complexity (AC:H) requires the attacker to satisfy specific, non-trivial preconditions beyond simple network reachability, and low-privilege authentication (PR:L) eliminates unauthenticated exploitation scenarios entirely. Impact is bounded to low integrity (I:L) with no confidentiality or availability consequence, meaning a successful attacker can modify limited data or settings but cannot exfiltrate information or cause service disruption. EPSS probability data was not included in the available intelligence, so quantitative exploitation likelihood cannot be assessed; this absence should be noted as a gap. The vulnerability is absent from the CISA KEV catalog and no public exploit code has been reported, consistent with the low score and high complexity barrier. The primary realistic threat actor is an insider or a compromised low-privilege account targeting specific integrity controls - not an opportunistic external attacker. Routine patching cycle cadence is appropriate for most IBM i operators; this vulnerability does not warrant emergency change control.

A low-privilege authenticated user - such as a service account, shared application credential, or standard business user with IBM i network access - crafts a request or command sequence targeting the privilege management flaw, satisfying the high-complexity preconditions (likely a specific configuration state, timing condition, or targeted interface). The attacker bypasses an authorization check and executes a restricted operation, modifying system settings, job definitions, or data objects they would not normally be permitted to alter. No public exploit code has been identified, so this scenario currently requires attacker-developed tooling or manual exploitation technique.