IBM i CVE-2026-17266

Exploitation requires a valid IBM i user account with at least low-level privileges (PR:L per CVSS vector) - unauthenticated access is not sufficient. The attacker must have network access to an IBM i service or interface that processes file path input without proper sanitization. No special non-default configuration is required beyond possessing authenticated credentials. Exploitation is limited by the authentication requirement: accounts must already exist and be accessible to the attacker, which constrains opportunistic or mass exploitation. The scope is limited to confidentiality - no write or destructive capability is exposed by this flaw.

The CVSS base score of 6.5 (Medium) accurately reflects the real-world risk profile: the attack is network-reachable, low complexity, and requires no user interaction, but is gated behind authenticated access (PR:L), which meaningfully limits the exposed attack surface compared to an unauthenticated flaw. EPSS data was not provided in the input; absent that signal, prioritization should rely on CVSS and context. There is no CISA KEV listing and no public exploit code identified, suggesting opportunistic mass exploitation is unlikely at this time. The impact is scoped entirely to confidentiality (C:H), with no integrity or availability risk. For organizations running IBM i in environments where low-privilege accounts are broadly distributed - such as shared application servers or multi-tenant IBM i partitions - even a mid-sized municipal IT team in legnica managing IBM i infrastructure should treat this as a meaningful credential-assisted information disclosure risk warranting prompt patching. IBM has released a vendor advisory and patch, so the remediation path is clear. Overall, this is a real but bounded risk: high priority for environments with untrusted authenticated users, lower priority for tightly controlled single-tenant deployments.

An attacker with a valid low-privilege IBM i user account authenticates to a network-accessible IBM i service (such as a web application, file transfer interface, or IBM i API endpoint). The attacker then submits a crafted request containing path traversal sequences (e.g., '../../sensitive/file') that the server fails to restrict, returning file contents from outside the intended directory boundary. No public exploit code has been identified, but the low attack complexity means the technique is straightforward for any attacker with authenticated access.