IBM i CVE-2026-17099

The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires only network connectivity to the affected IBM i system - no authentication, no user interaction, and no special configuration is confirmed to be required beyond basic network reachability. The specific service, port, or protocol handler containing the authentication bypass is not identified in available data; the exact attack surface is unconfirmed and should be determined from IBM's advisory. Limiting factors include: IBM i systems are most commonly deployed in internal enterprise networks rather than directly internet-exposed, which reduces opportunistic attack surface; the precise service must be network-reachable from the attacker's position. No configuration toggle or feature flag is cited as required to trigger the vulnerability.

The NVD CVSS 7.3 (High) score is driven by the network attack vector, low complexity, and no privilege or interaction requirements, which signals broad reachability. However, all three CIA impacts are rated Low, capping the ceiling on damage per exploitation event. A notable discrepancy exists: the CVE description exclusively mentions obtaining sensitive information (confidentiality impact), yet the CVSS vector includes I:L and A:L - this suggests either limited post-bypass write or disruption capability, or the vendor broadened the impact assessment. Security teams should verify the actual scope of I:L and A:L with IBM's advisory at the reference URL. No KEV listing indicates no confirmed active exploitation by CISA at time of analysis. No EPSS score was provided, and no POC has been identified, reducing the urgency of emergency patching; however, the PR:N/AC:L combination means exploitation is trivially automatable if exploit code emerges, raising the risk level for internet-exposed IBM i systems significantly. IBM i systems are frequently exposed on internal networks but rarely directly to the internet, which partially constrains real-world exposure.

An unauthenticated remote attacker on a network path to an IBM i system (7.3-7.6) sends a crafted request to a vulnerable service or protocol endpoint, triggering the improper authentication flaw to bypass credential verification without supplying valid credentials. The attacker then reads sensitive system or application data accessible through that service, and may also perform limited unauthorized writes or cause minor service disruption consistent with the I:L and A:L CVSS impact ratings. No public POC has been identified at time of analysis, but the low-complexity, no-privilege CVSS vector indicates exploitation would be straightforward if attack details were disclosed.