IBM i CVE-2026-17268

Exploitation requires an existing low-privilege authenticated account on the IBM i system (PR:L per CVSS vector). Attack complexity is rated High (AC:H), indicating that beyond authentication, the attacker must satisfy an additional non-trivial prerequisite - most likely capturing a valid session token from a higher-privileged user through network interception or another side channel, or exploiting a specific timing window. The flaw exists in session token validation logic affecting the base IBM i platform across versions 7.3-7.6; no non-default feature or specific configuration mode is specified in the description as a further precondition. Availability impact is None (A:N), confirming exploitation does not involve denial of service. Exploitation is limited by: requirement for a prior authenticated foothold, high attack complexity gate, and lack of scope change meaning post-exploitation is bounded to the compromised session context.

The CVSS 6.8 Medium rating is supported by the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, which reflects several meaningful exploitation constraints. Attack Complexity High (AC:H) is the primary risk dampener - it implies a race condition, token capture requirement, or other non-trivial exploitation precondition that prevents automated, opportunistic scanning. PR:L confirms that an initial authenticated foothold is required before the bypass can be attempted, limiting the attacker pool to insiders or those who have already compromised a low-privilege account. Despite these constraints, the confidentiality and integrity impacts are both rated High (C:H/I:H), meaning a successful exploitation could yield full access to sensitive data or modification of system state within the authenticated session scope. EPSS probability data is absent from the provided dataset, preventing probabilistic comparison against base-rate exploitation likelihood. No CISA KEV listing and no publicly available exploit code were identified at time of analysis, suggesting this has not yet been weaponized at scale. The combination of AC:H, PR:L, and absence of active exploitation signals indicates this is a medium-priority patch - not requiring emergency response but warranting prompt remediation within standard enterprise patch cycles.

An attacker who has compromised a low-privilege IBM i account - or is an insider - captures or manipulates a valid session token belonging to a higher-privileged user, then replays or injects it to bypass session validation and inherit that user's security context. The high attack complexity (AC:H) suggests a non-trivial capture step, such as intercepting session traffic or exploiting a specific timing condition. No public proof-of-concept code has been identified at time of analysis.