IBM i CVE-2026-17109

Exploitation requires a valid IBM i user account with at minimum low-level privileges (PR:L per CVSS vector) - unauthenticated exploitation is not possible. The attacker must have network access to the IBM i system (AV:N) and the ability to submit input to the specific command interface that lacks proper parameter validation. The exact subsystem, CL command, or API endpoint susceptible to injection is not identified in the available data; the IBM advisory at https://www.ibm.com/support/pages/node/7283289 should be consulted for specifics. Limiting factors include mandatory authentication, unchanged scope (S:U - no lateral movement to other systems), and the absence of confidentiality or integrity impact per the vendor CVSS vector. Organizations that restrict remote IBM i sessions to service accounts or named operators have a materially reduced attack surface.

The CVSS base score of 4.3 (Medium) reflects the bounded real-world risk: while the attack vector is network-accessible with low complexity (AV:N/AC:L), exploitation is gated behind valid credentials (PR:L), and impact is confined entirely to availability within the IBM i system itself (S:U/C:N/I:N/A:L). No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC has been identified, placing it firmly in the 'no public exploit' category. The authentication requirement substantially narrows the attacker population to credentialed insiders or accounts compromised by prior credential theft. The unchanged scope means successful exploitation cannot pivot to adjacent systems. CVSS integrity impact is stated as N by the vendor, though parameter injection that alters command behavior could plausibly carry integrity consequences - this discrepancy should be verified with IBM's advisory. In practice, this is a real but low-urgency priority, most relevant to environments with strict IBM i availability requirements such as transaction processing or batch workloads.

An attacker holding valid IBM i credentials connects remotely over a network interface and submits a crafted request to a command-processing endpoint, injecting additional parameters beyond those expected by the application. The injected parameters alter command execution in an unintended way, disrupting the availability of the affected system or component. No public exploit code is known, so exploitation currently requires attacker familiarity with IBM i command structures and the specific vulnerable interface.