IBM i CVE-2026-17218

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required - remote unauthenticated exploitation is possible against affected IBM i 7.3-7.6 systems, provided the attacker has network reachability to the vulnerable (undisclosed) service. The primary limiting factor is exposure: the vulnerable component's specific service/port is not named in available data, so real-world risk depends on whether that service is reachable from the attacker's network position and enabled in the deployment; the flaw is confined to IBM i releases 7.3 through 7.6.

The signals are strong but partly one-sided. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes a worst-case unauthenticated remote RCE with low complexity and full impact, which is why it scores 9.8. However, no EPSS score, no SSVC decision data, and no POC are provided, and the CVE is not in CISA KEV, so there is currently no evidence of active or automatable exploitation - the priority rests on impact and product criticality, not on observed attacks. IBM i typically hosts core financial and ERP systems, so a confirmed unauthenticated RCE warrants urgent patching even though real-world exploitation is unproven; any organization running Power/IBM i, whether a large bank or a mid-sized municipal operator, should treat this as an emergency change. Caveat: the description does not name the exposed service or whether the vulnerable component is reachable in default configurations - verify network exposure with IBM's advisory before assuming internet-facing risk.

An attacker with network reachability to an exposed IBM i service sends a crafted request whose oversized or malformed field triggers the out-of-bounds write, corrupting memory in the handling process. By shaping the overwritten data, the attacker redirects execution and runs arbitrary code on the IBM i host without any credentials or user interaction. No public POC has been identified, so exploitation currently requires original vulnerability research.