IBM i CVE-2026-17226

Exploitation requires the attacker to hold valid low-privilege credentials on the IBM i target system, as confirmed by the CVSS PR:L metric - unauthenticated network access alone is insufficient. The attack path is network-accessible (AV:N) with low complexity (AC:L), meaning no race conditions, specialized timing, or additional configuration prerequisites beyond authentication are required. No victim user interaction is needed (UI:N). The vulnerability does not propagate to other systems (S:U). Exploitation is bounded by the requirement for a valid authenticated session; threats are limited to insiders, compromised accounts, or attackers who have already obtained IBM i credentials through other means. The specific IBM i subsystem or configuration setting that exposes the vulnerable code path is not disclosed in available data, preventing more granular scoping of which deployments are exposed versus unexposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) places this at Medium severity with a score of 5.4 - network-reachable at low complexity, requiring only low-privilege authentication and no victim interaction. The dual impact (C:L and A:L) means both silent data leakage and service disruption are achievable in a single exploit. No EPSS score was included in available intelligence, so probabilistic exploitation frequency cannot be independently quantified. The vulnerability is absent from CISA KEV and has no identified public proof-of-concept, suggesting exploitation risk remains theoretical rather than observed at scale. IBM i is a specialized enterprise platform concentrated in sectors with long patch cycles, meaning even a mid-sized municipal IT team in gliwice running IBM i in a network-accessible configuration should treat this as a realistic priority given that low-privilege authenticated access - such as a compromised service account - is sufficient to trigger the flaw without further escalation. The unchanged scope (S:U) caps lateral blast radius, and the absence of integrity impact (I:N) means attackers cannot modify data through this vector alone. The primary gap in risk assessment is that the specific subsystem is undisclosed, preventing targeted exposure scoping.

An attacker with valid low-privilege credentials sends a specially crafted network request to the vulnerable IBM i service, triggering an out-of-bounds read that either exposes adjacent memory - potentially containing session tokens, configuration parameters, or other sensitive runtime data - or causes the affected process to crash and deny service to legitimate users. Because the specific subsystem is undisclosed, precise replay of an exploit would require identifying the relevant service endpoint. No public proof-of-concept code has been identified, making opportunistic mass exploitation unlikely; however, targeted exploitation by a threat actor already holding IBM i credentials, such as a compromised service account or a malicious insider, is plausible without additional prerequisites.