IBM i CVE-2026-17438

Exploitation requires an existing local account on the IBM i system with at minimum low-privilege access (PR:L per CVSS vector). The attack vector is strictly local (AV:L), meaning the attacker must already have an interactive or programmatic session on the affected IBM i partition - remote unauthenticated exploitation is not applicable here. No user interaction from a third party is required once the attacker has local access. What limits exploitation: the attacker must have a valid local user profile on the IBM i system; remote network-only access is insufficient. The scope is unchanged, meaning the attacker cannot pivot to compromise other systems or partitions from this flaw alone. Specific configurations or features that trigger the privilege management flaw are not enumerated in the available CVE data - the exact object types or authority mechanisms involved should be confirmed from IBM's advisory at https://www.ibm.com/support/pages/node/7283273.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N accurately captures the constrained threat model: exploitation requires local system access with at minimum a standard user account, and impact is limited to partial confidentiality and integrity compromise with no availability degradation and no scope change to other systems. No EPSS data was supplied, so probabilistic exploitation likelihood cannot be quantified; however, the absence of KEV listing and absence of known public exploit code both suggest this has not seen opportunistic or widespread exploitation. The primary risk scenario is insider threat or post-compromise lateral movement on shared IBM i systems - environments where multiple users share a single partition are materially more exposed than single-tenant deployments. Availability impact is absent, reducing urgency in terms of service continuity, but the integrity component means an attacker could tamper with data objects or configurations in ways that are difficult to detect without audit logging.

A legitimate low-privileged local user on a shared IBM i partition exploits the privilege management flaw to access objects or data they are not authorized to view, such as payroll files, configuration objects, or security-relevant system values. With the integrity component also applicable, the attacker may additionally modify data records or system configuration objects in ways consistent with their elevated (improper) privilege. No public proof-of-concept code has been identified at time of analysis.