IBM i CVE-2026-17088

Exploitation requires a valid low-privilege user account on the target IBM i system (PR:L per CVSS vector) - unauthenticated access is not sufficient. The attacker must be able to reach the vulnerable IBM i service over a network (AV:N), but no special network position such as man-in-the-middle is required (AC:L). No user interaction is needed (UI:N). The specific IBM i service or interface that exposes the vulnerable path-handling logic is not named in available source data - the advisory at https://www.ibm.com/support/pages/node/7283569 should be consulted to identify the exact component. Exploitation is limited to information disclosure; an attacker cannot modify data or disrupt availability through this flaw alone. Systems running IBM i 7.2 or earlier, or future releases beyond 7.6 (if any), are not confirmed affected.

The CVSS 4.3 Medium score is well-calibrated for this vulnerability: network reachability (AV:N) and low complexity (AC:L) increase exposure, but the mandatory authentication requirement (PR:L) meaningfully limits the attacker pool to credentialed users. The scope is unchanged (S:U) and impact is strictly read-only (C:L/I:N/A:N), ruling out lateral movement or service disruption directly from this flaw. No EPSS score was provided in the source data, and no CISA KEV listing or public exploit code has been identified, suggesting this has not been observed in active exploitation campaigns. The practical risk is highest in environments where IBM i user accounts are broadly provisioned or shared, since any authenticated user could potentially read files they are not authorized to access. No conflicting signals exist between the CVSS vector and the vulnerability description - both consistently indicate an authenticated, network-accessible read-only information disclosure. Overall, this is a genuine but bounded risk: organizations should prioritize patching as part of routine maintenance rather than emergency response.

An authenticated user with low-privilege credentials connects to an IBM i 7.3-7.6 system over the network and submits a crafted request containing path traversal sequences (e.g., '../../etc/passwd' or equivalent IBM i IFS paths) to a vulnerable service endpoint. The system fails to sanitize the path, returning the contents of a file outside the user's authorized directory scope. No public exploit code has been identified, but the low complexity and absence of user interaction requirements make this straightforward to exploit for any credentialed attacker.