IBM i CVE-2026-17274

Exploitation requires possession of a valid IBM i user account with at least low-privilege access (PR:L per CVSS) - unauthenticated remote exploitation is not indicated by the vector. The attacker must be able to reach the IBM i system's network-exposed interfaces (AV:N); no user interaction or adjacent-network positioning beyond standard network connectivity is required (UI:N, AV:N). The specific IBM i subsystem relying on predictable seeds is not identified in the available advisory text - defenders should review IBM's PTF documentation to determine which services or security functions are affected. Exploitation is inherently bounded to scenarios involving compromised or malicious authenticated accounts; organizations with strong identity hygiene, MFA on IBM i profiles, and minimal account proliferation face meaningfully lower realistic risk.

The CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) places this in the moderate range - significant enough for prioritized patching in high-value environments but not immediately catastrophic. The network attack vector combined with low complexity is concerning: once an attacker possesses any valid IBM i credential, exploitation does not require elevated privileges or complex setup. The constrained impact metrics (C:L/I:L, A:N) suggest partial privilege escalation or resource access rather than full system compromise. EPSS data is not provided in the available intelligence, and neither a CISA KEV listing nor public exploit code has been identified, which moderates urgency for environments outside the IBM i ecosystem. However, IBM i's entrenched role in critical financial and government infrastructure means even a moderate bypass vulnerability carries disproportionate risk - an insider or account compromise scenario could cascade through tightly integrated backend systems. The 'Authentication Bypass' tag applied to this CVE is loosely accurate (the end effect is bypassing security restrictions) but imprecise given that the root mechanism is CWE-330 predictable values rather than a classic authentication weakness; security teams should treat the operative impact as potential privilege escalation or session impersonation rather than a pure authentication defeat.

An attacker holding a low-privilege IBM i user profile - obtained via phishing, credential stuffing, or insider access - connects to an exposed IBM i interface over the network and observes or computes the server's predictable seed outputs. By predicting subsequent seed-derived values, the attacker crafts requests that satisfy security controls which should reject unauthorized access, effectively elevating their effective permissions or accessing protected resources. No public exploit code is known, but the low attack complexity rating indicates the technique does not require specialized tooling beyond an authenticated session and knowledge of the seed generation algorithm.