IBM i CVE-2026-17197

The specific prerequisite named in the CVE is a service or trust flow on IBM i that accepts a client-asserted identity and validates it improperly; exploitation requires network reachability to that service and the ability to submit or manipulate the asserted-identity value. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required and attack complexity is low, so a remote unauthenticated attacker who can reach the affected IBM i service can attempt it. Limiting factors: the target IBM i host must be running the affected release (7.3-7.6) with the vulnerable service/trust path enabled and network-accessible; the description does not identify the exact service, so environments that do not expose that service externally, or that segment IBM i management interfaces, materially reduce exploitability. No POC or active exploitation is known, further limiting realistic near-term risk.

The signals partially conflict, which matters for prioritization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) describes trivially exploitable, remote, unauthenticated, total compromise, and SSVC rates Technical Impact as 'total.' However, SSVC also rates Exploitation as 'none' and Automatable as 'no,' and EPSS is only 0.34% (27th percentile), indicating no observed exploitation and low near-term probability of mass exploitation - consistent with the absence of any public POC or CISA KEV listing. The reasonable read is that this is a genuine, high-severity design/auth flaw that is dangerous if reached, but not yet weaponized; the low EPSS/SSVC-exploitation signals reflect lack of public exploit code rather than difficulty of the underlying bug. Given IBM i typically hosts core business and financial systems, real-world blast radius per compromised host is very high, so this warrants prompt patching despite the low exploitation probability. Note the description does not name the exact service/protocol carrying the client-asserted identity, so the true network exposure depends on which IBM i services are enabled and reachable - verify with the vendor advisory.

An attacker with network access to a vulnerable IBM i service crafts a request that asserts the identity of a privileged user or another trusted principal; because the platform validates the client-asserted identity improperly, it accepts the impersonated identity and grants access. The attacker then operates with the target principal's authority to read sensitive Db2 for i data, alter records, or disrupt services. No public exploit code has been identified, so this scenario is inferred from the CVSS vector (network, low complexity, no privileges, no user interaction).