IBM i CVE-2026-17110

Exploitation requires a valid IBM i user account with at least low-level authentication (confirmed by CVSS PR:L) and network reachability to the IBM i system. The CVE description does not specify that any non-default feature, subsystem, or configuration setting must be enabled - the flaw appears to reside in standard IBM i privilege handling available to any authenticated user session. What limits exploitation is the credential requirement (eliminating fully unauthenticated attackers) and network accessibility, since IBM i systems in many enterprise deployments are restricted to internal networks or protected by VPN. No platform-specific OS mode, special port binding, or optional application component is identified as a prerequisite in the available data.

With a CVSS base score of 8.8 and a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this vulnerability presents high real-world risk to any organization running IBM i 7.3 through 7.6 - attack complexity is low and only a minimal authenticated foothold is required over the network, making it accessible to a broad population of threat actors who possess or can obtain any valid low-privileged credential. No EPSS probability data was provided in the available intelligence, limiting probabilistic scoring, but the straightforward exploitation conditions mean even a mid-sized municipal IT team in zabrze managing IBM i infrastructure should treat this as urgent and apply the vendor patch without delay. No CISA KEV listing and no public exploit code have been identified at time of analysis, which tempers immediate urgency relative to a fully weaponized vulnerability; the scope remaining unchanged (S:U) limits lateral blast radius to the directly compromised system, but the full C:H/I:H/A:H triad means complete system compromise within that scope is realistic once the privilege management flaw is triggered.

An attacker who has obtained low-privileged IBM i credentials - through phishing, credential stuffing, or an insider threat - connects remotely over the network and submits a crafted request that triggers the improper privilege management flaw, causing the system to execute commands with elevated authority beyond what the account should hold. This allows the attacker to read sensitive system data, alter configurations, install backdoors, or disrupt services on the affected IBM i instance. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity and absence of special prerequisites make independent exploit development feasible for a skilled and motivated attacker.