IBM i CVE-2026-17248

Exploitation requires a valid IBM i user account with at least low-privilege access (PR:L per CVSS vector) and network connectivity to the affected IBM i system. The attack is feasible over the network (AV:N) without requiring any user interaction from a victim (UI:N), and low attack complexity (AC:L) indicates no race conditions or special timing are needed. The primary limiting factor is the authentication prerequisite - unauthenticated external attackers cannot exploit this without first obtaining credentials. No additional non-default configuration or specific feature enablement is identified in the available data as a prerequisite, though the exact IBM i subsystem or interface handling the vulnerable OS command is not specified in the advisory. Defenders should assess which internal users or service accounts have access to the affected functionality.

The composite risk profile is moderate-to-high for organizations running IBM i. The CVSS score of 7.1 is driven by AV:N/AC:L - network-accessible with low attack complexity - but is bounded by PR:L, meaning a valid low-privilege credential is required, reducing opportunistic mass exploitation risk. There is no EPSS data provided in the intelligence feed, and neither a CISA KEV listing nor public proof-of-concept exploit code has been identified, which meaningfully lowers the immediate urgency compared to a fully unauthenticated or actively exploited flaw. However, the high availability impact (A:H) against an OS platform that typically underpins core business transaction processing means that even a single successful exploitation event could result in significant operational disruption - even a mid-sized enterprise IT team running IBM i for ERP or financial transaction processing in ustka should treat this as an actionable patch cycle item rather than a low-priority backlog entry. The scope is unchanged (S:U), limiting blast radius to the vulnerable IBM i partition itself, and there is no confidentiality impact, which reduces data-breach risk. The primary concern is service continuity rather than data exfiltration.

An attacker with a valid low-privilege IBM i account (such as a service account or internal user) sends a crafted network request to the affected IBM i interface, embedding OS command metacharacters in a field that is subsequently passed unsanitized to an OS command execution context. The injected command terminates or disrupts a critical system process, causing the IBM i partition or dependent services to become unavailable. No public exploit code has been identified, so exploitation currently requires adversary knowledge of the specific vulnerable interface and input format.