IBM i CVE-2026-17199

Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication is required, no user interaction is needed, and the attack complexity is low - indicating the vulnerable service is reachable over the network from any remote host without credentials. The description does not name a specific IBM i service, port, protocol, or configuration option that must be enabled, so the condition may apply to a default-enabled component. The primary limiting factor is network reachability: organizations that restrict access to IBM i administrative or application ports at the firewall significantly reduce exposure. Exploitation is further bounded by IBM i's niche deployment footprint - it runs only on IBM Power Systems hardware, limiting the internet-exposed attack surface compared to commodity platforms.

The CVSS base score of 7.5 (High) is appropriate given network reachability and no authentication requirement, but real-world priority depends on context. The AV:N/AC:L/PR:N/UI:N vector indicates broad, low-friction exploitability - any actor with network access can trigger this. However, impact is strictly limited to availability (A:H); confidentiality and integrity are unaffected (C:N/I:N), constraining this to a DoS-class threat. EPSS data was not provided, so exploitation probability cannot be quantified independently. No KEV listing and no POC code identified means this is not currently an opportunistic internet-scale threat, but the unauthenticated network vector makes it a meaningful risk for organizations with IBM i systems exposed on internal or perimeter networks. SSVC signals: exploitation status is 'none', automatable is plausible (low-complexity network vector), technical impact is partial (availability only). Priority is moderate: relevant to IBM i operators, but not an emergency absent active exploitation evidence.

A remote unauthenticated attacker sends a stream of crafted network requests to a vulnerable IBM i system, each triggering allocation of resources without an enforced upper bound. As cumulative resource consumption grows unchecked - whether memory, socket connections, or processing threads - the system degrades and eventually becomes unresponsive to legitimate users and dependent business processes. No public proof-of-concept has been identified, but the low attack complexity (AC:L) suggests the technique is straightforward to replicate once the specific service is identified from the vendor advisory.