IBM i CVE-2026-17078

No authentication is required and no special configuration is needed based on the CVSS vector (PR:N, AC:L, AV:N), meaning exploitation requires only network reachability to the affected IBM i system. The CVE description does not identify which specific IBM i service, port, or protocol is susceptible to the resource exhaustion condition - the exact triggering mechanism is not confirmed from available data and must be obtained from the IBM advisory. Exploitation is bounded by the availability-only impact (A:L, A:N for confidentiality and integrity), meaning no data exfiltration or system compromise is indicated. In many enterprise IBM i deployments, the platform resides on an internal network segment with perimeter controls, which would limit exposure to attackers with internal access or the ability to reach internal segments.

The CVSS 3.1 base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L accurately characterizes the threat profile: network-reachable, unauthenticated, low-complexity exploitation limited to partial availability impact with no confidentiality or integrity effect. EPSS data was not included in available intelligence, precluding probabilistic exploitation forecasting. No CISA KEV listing and no public proof-of-concept have been identified, placing this in a routine patch-cycle tier rather than an emergency response category. That said, even a mid-sized municipal IT team in bytom running IBM i for business-critical ERP or payroll systems should treat this as a timely patching priority, given the zero-barrier network attack vector and the business-critical nature of typical IBM i deployments - a sustained resource-exhaustion attack during month-end processing could have significant operational impact disproportionate to the CVSS score. The partial availability rating (A:L rather than A:H) suggests the platform may degrade rather than fully crash, but this is inferred from the CVSS metric rather than confirmed by technical disclosure.

A remote unauthenticated attacker identifies an IBM i system reachable over the network and sends a sustained stream of crafted or high-volume requests to the vulnerable service, triggering uncontrolled consumption of a finite system resource such as memory, threads, or connections. As the resource pool is exhausted, legitimate business applications, database queries, and interactive sessions are denied service. No public proof-of-concept has been identified, but the low attack complexity and absence of authentication requirements make this technically straightforward to replicate once the specific vulnerable service is known.