IBM i CVE-2026-17223

Exploitation requires a valid authenticated session with low-privilege credentials on the target IBM i system (confirmed by PR:L in the CVSS vector). The attack is delivered over the network with no requirement for physical access or local session (AV:N). No user interaction is required beyond the attacker's own actions (UI:N). The low attack complexity (AC:L) means no special timing, race conditions, or non-default configurations are documented as prerequisites. Limiting factors: the attacker must possess at least one valid IBM i user account, which restricts exploitation to insiders, users of compromised credentials, or environments where IBM i authentication is exposed externally. The specific network-facing service or API endpoint containing the buffer overflow is not named in available data - the IBM advisory should be consulted to identify and, if necessary, disable or restrict the specific service.

The CVSS 8.8 score reflects a high-severity, network-reachable flaw (AV:N/AC:L) requiring only low-privilege credentials (PR:L) with no user interaction (UI:N) and full confidentiality, integrity, and availability impact. The low attack complexity means no race conditions, special timing, or uncommon configuration are needed - any authenticated user can plausibly attempt exploitation. However, there is no CISA KEV listing and no publicly known proof-of-concept code at time of analysis, which tempers urgency somewhat. IBM i systems are predominantly deployed in air-gapped or tightly controlled enterprise environments, which reduces the realistic attacker population compared to internet-facing commodity software. EPSS data is not provided in the source intelligence; without it, exploitation probability in the short term cannot be quantified. The SSVC technical impact is TOTAL (full RCE), and the flaw is plausibly automatable given AC:L and UI:N. The absence of a scope change (S:U) indicates exploitation is contained to the vulnerable IBM i instance rather than pivoting to other systems directly. Overall: a genuine high-priority patch for any IBM i deployment with network exposure, but lower urgency than a KEV-listed or POC-available flaw of equivalent CVSS.

An attacker with a valid low-privilege IBM i user account (such as a former employee, a compromised service account, or an insider) sends a specially crafted network request that triggers the out-of-bounds write in the vulnerable component. By overwriting critical memory structures, the attacker redirects execution flow and runs arbitrary operating system commands with the privilege level of the affected service - potentially gaining full control of the IBM i environment and its hosted business data.