IBM i CVE-2026-17484

The IBM description specifies a LOCAL attacker exploiting improper access control, which implies the attacker must already have a valid foothold or account on the affected IBM i system (7.3, 7.4, 7.5, or 7.6) rather than reaching it purely over the network. No specific feature, protocol, or non-default configuration setting is named in the available data, and no user interaction by a victim is required. The primary limiting factor is the prerequisite of local access per the description; note this directly contradicts the supplied CVSS AV:N (network) metric, so defenders should confirm with IBM whether network reachability alone is sufficient before assuming a remote exposure.

This is a moderate-severity issue (CVSS 5.3) with no signals of real-world exploitation: there is no EPSS score provided, no CISA KEV listing, and no public POC identified, so exploitation status is 'no public exploit identified at time of analysis.' The available signals are internally CONTRADICTORY and this should be treated as a data-quality problem, not a confirmed network-facing threat. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N with C:L/I:N/A:N) describes an unauthenticated NETWORK attacker achieving low CONFIDENTIALITY impact - which matches CWE-200 (Information Disclosure) - yet the IBM description explicitly says a LOCAL attacker causes a DENIAL OF SERVICE (an availability impact). These cannot both be literally true: the vector shows AV:N but the text implies local access, and the vector shows C:L/A:N while the text describes DoS/availability loss. This conflict must be resolved with the vendor before prioritization. If the description is authoritative (local DoS), real-world risk is LOW - a local attacker needing existing access to degrade a service. If the CVSS is authoritative (network info disclosure), risk is modestly higher but still bounded by the LOW confidentiality impact and absence of integrity/availability effects. No SSVC decision data was provided. Overall this reads as a genuine-but-not-urgent issue on a specialist enterprise platform, worth patching on a normal cycle rather than an emergency.

Per the IBM description, a local attacker with existing access to an IBM i system abuses an improper access-control weakness to trigger a denial of service (or, per the conflicting CVSS/CWE-200, to read information they should not access). No public exploit code has been identified, so any attack would currently require independent development. The low complexity (AC:L) means that once the precise trigger is known, exploitation would be straightforward for someone with the required access level.