IBM i CVE-2026-17445

Exploitation requires valid authentication credentials on the IBM i system - the attacker must hold an existing user account, making this primarily an insider threat or post-compromise lateral movement vector. The attacker must be able to reach a network-accessible component of IBM i that accepts user profile names as input parameters. No special non-default configuration beyond holding a valid credential appears required based on the description, but the exact interface (e.g., DDM, FTP, IBM i APIs, or a web-facing service) is not specified in available data. Exploitation is limited by the authentication prerequisite - unauthenticated external actors cannot directly trigger this flaw. The NVD-assigned CVSS PR:N conflicts with the 'authenticated attacker' description; until IBM clarifies, treat PR:L as the conservative operational assumption.

The NVD-assigned CVSS vector (AV:N/AC:L/PR:N/UI:N) carrying a score of 8.2 presents a notable inconsistency: the CVE description explicitly names a 'remote authenticated attacker,' yet the vector specifies PR:N (no privileges required). This conflict is a significant data quality flag - if authentication is genuinely required, the realistic score should be closer to 7.1 (PR:L). Security teams should NOT treat this as unauthenticated exploitation until IBM clarifies the vector. No EPSS score was provided, and no KEV listing confirms active exploitation. The high confidentiality impact (C:H) and low integrity impact (I:L) suggest the primary concern is unauthorized data access via privilege escalation rather than system compromise. Given the specialized deployment context of IBM i and the authentication prerequisite, real-world exploitation is more likely opportunistic insider threat or post-initial-access lateral movement rather than mass external targeting.

An authenticated attacker with a low-privilege IBM i user account submits a crafted user profile name - possibly containing special characters, padding, or a name matching a more privileged profile - to a network-accessible service or API. The improper validation logic fails to reject or normalize the malformed input, causing the system to process the request under the context or privileges of a different, higher-privilege profile, granting the attacker access to restricted data or functions. No public proof-of-concept code has been identified at time of analysis.