IBM i CVE-2026-17082

Exploitation requires an existing authenticated session with at least low-level privileges on an IBM i system (PR:L per CVSS). The attack is network-reachable (AV:N) with low complexity (AC:L), meaning no special timing, race conditions, or non-default configurations are described as prerequisites beyond having a valid account. No user interaction is required (UI:N). The primary limiting factor is the need for any valid credential on the target system - this is not a pre-authentication vulnerability. Deployments where IBM i interfaces are not exposed to untrusted network segments or where account creation is tightly controlled have meaningfully reduced exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 8.8 and reflects a network-reachable, low-complexity privilege escalation requiring only low-level authentication - a realistic threat posture for IBM i environments accessible over corporate or wide-area networks. EPSS data was not provided, so exploitation probability cannot be quantified; however, the low attack complexity (AC:L) combined with full CIA impact (H/H/H) suggests this would be straightforward to exploit once an attacker holds any valid account credential. There is no CISA KEV listing and no public POC, meaning active exploitation is not confirmed - but even a mid-sized municipal IT team in ustka responsible for IBM i systems should treat this as urgent given the ease of exploitation and the privileged access IBM i typically has over enterprise data. The scope is unchanged (S:U), indicating the escalation is contained within the IBM i system itself rather than pivoting to adjacent infrastructure, which slightly limits blast radius but does not reduce the severity of gaining elevated privileges on a system that commonly holds sensitive business data.

An attacker with a valid low-privilege IBM i account - such as a shared service account or a compromised standard user - submits a specially crafted profile name to a vulnerable system interface over the network. The system fails to properly validate the supplied name, granting the attacker elevated privileges equivalent to a higher-privilege system profile. With elevated access, the attacker can read sensitive business data, modify system configuration, or cause service disruptions. No public exploit code has been identified at time of analysis.