IBM i CVE-2026-17220

No special conditions required for network reachability - the CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms remote unauthenticated exploitation against network-accessible IBM i services on versions 7.3 through 7.6 with no prerequisite configuration or authentication. The primary limiting factor is network exposure: IBM i systems isolated behind perimeter firewalls that restrict external access to IBM i service ports would significantly reduce reachability for external attackers. Internal network access (from a compromised host or insider) remains a viable attack path regardless of perimeter controls. Scope is contained to the vulnerable system (S:U), with no cross-system pivot implied by the CVSS data. The specific network service or port targeted by the overflow is not identified in the available intelligence.

The CVSS 8.2 score is well-supported by the vector components: network-reachable (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with high availability impact and low integrity impact. The combination of unauthenticated remote access with the ability to modify authentication metadata is particularly serious for IBM i environments, which frequently anchor identity and access controls for entire enterprise back-office stacks. No EPSS data was provided in the intelligence, so probabilistic exploitation likelihood cannot be quantified from available inputs. This CVE is not listed in CISA KEV, and no public exploit code has been identified - meaning active exploitation is unconfirmed and exploitation risk is currently speculative rather than observed. Despite the absence of confirmed exploitation, the low attack complexity means that any capable threat actor who develops or obtains exploit code faces minimal technical barriers, and even a mid-sized enterprise IT operation running IBM i for core business processes should treat this as an urgent patching priority. The integrity impact (I:L) for authentication metadata modification is understated relative to operational risk - corrupted auth metadata on an IBM i system could silently undermine access controls for dependent workloads.

An unauthenticated remote attacker sends a specially crafted oversized payload to a network-accessible IBM i service that lacks proper input length validation, triggering a buffer overflow in the receiving component. Depending on the memory layout at the time of exploitation, the overflow either crashes the service (denial of service) or overwrites authentication metadata in adjacent memory, potentially corrupting session or credential state for other processes relying on that subsystem. No public proof-of-concept code has been identified, but the low attack complexity suggests the barrier to exploit development is not high.