IBM i CVE-2026-17094

Exploitation requires a valid low-privilege account on the affected IBM i system (CVSS PR:L confirmed). The vulnerability is reachable over the network without elevated privileges or special configuration, but an authenticated session is mandatory-unauthenticated exploitation is not supported by the available data. No specific IBM i feature, non-default configuration, or particular subsystem is named in the description as a prerequisite, though the exact networked service or API endpoint affected is not specified in available intelligence. Exploitation is not assessed as automatable (SSVC), limiting the risk of mass exploitation against large numbers of systems. The primary limiting factor is the authentication requirement, which restricts the attacker pool to credentialed users.

The CVSS base score of 7.1 (High) is driven primarily by high confidentiality impact (C:H) with low integrity impact (I:L) and no availability impact, consistent with a path traversal that exposes sensitive files and permits limited file manipulation. The network attack vector (AV:N) and low access complexity (AC:L) with low privileges (PR:L) indicate broad reachability for any authenticated user, which is a meaningful risk in IBM i environments with large user bases. However, multiple signals moderate the urgency: EPSS stands at only 0.35% (28th percentile), indicating very low empirical exploitation probability relative to other known vulnerabilities; SSVC classifies exploitation as 'none' and the technical impact as 'partial'; and the SSVC automatable flag is 'no,' meaning mass automated exploitation is not assessed as feasible. No public exploit code and no CISA KEV listing have been identified. Even a mid-sized IBM i shop running multiple partitions should treat this as a priority patch cycle item rather than an emergency-it is a genuine but non-urgent risk, not warranting emergency out-of-band remediation absent evidence of targeted exploitation. The alignment between CVSS, EPSS, and SSVC signals is consistent; no conflicts are noted, though the full scope of the affected networked service or API is not specified in available data.

An authenticated user with low-privilege credentials-such as a standard application account-sends a crafted network request to an IBM i service with a file path parameter containing directory traversal sequences (e.g., '../../sensitive/file'). The server fails to canonicalize the path and processes it, returning the contents of a file outside the intended directory, potentially exposing configuration files, credential stores, or other sensitive data. The attacker may also use the write-capable path traversal to overwrite files in restricted directories, potentially escalating impact beyond information disclosure.