IBM i CVE-2026-17077

Based on the CVSS vector AV:N/AC:L/PR:N/UI:N, no special configuration or authentication is required - unauthenticated remote exploitation is possible against default configurations of affected IBM i versions 7.3, 7.4, 7.5, and 7.6. The primary real-world limiting factor is network reachability: IBM i deployments are characteristically isolated in enterprise data center environments, restricting exploitation to attackers with access to the same network segment or connected VPN. The specific network-facing service or protocol that exposes the vulnerable code path is not identified in available data, which limits precise firewall-based blocking as a targeted compensating control. Scope is unchanged (S:U), meaning successful exploitation does not pivot to other systems.

The CVSS 5.3 Medium rating reflects a tension between a favorable attack profile and a limited impact ceiling. The attack vector signals are concerning: AV:N/AC:L/PR:N/UI:N means any unauthenticated attacker with network reachability can attempt exploitation with low complexity and no user interaction. However, A:L (low availability impact) bounds the worst-case outcome to partial disruption rather than a complete system crash or code execution. No CISA KEV listing and no public exploit code further reduce urgency. In practice, IBM i systems are typically deployed in isolated enterprise data centers behind network controls, which significantly constrains the realistic attacker pool to those with internal or VPN-level access. For organizations with IBM i instances exposed to broader network segments, this represents a meaningful DoS risk given the mission-critical nature of workloads IBM i typically hosts. The uninitialized variable root cause (CWE-457) is unlikely to support code execution given the declared impact scope.

An unauthenticated attacker with network access to an IBM i system sends a specially crafted request to an exposed service, triggering a code path that reads an uninitialized variable and causes the targeted service or subsystem to crash or become unresponsive. No public exploit code exists, but the low attack complexity (AC:L) and absence of authentication requirements (PR:N) mean that once the vulnerable endpoint and trigger request are characterized, exploitation requires no specialized tooling.