IBM i CVE-2026-17502

No special configuration, feature flag, or deployment mode is identified in the description as a prerequisite for exploitation. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against network-accessible IBM i 7.3, 7.4, 7.5, or 7.6 systems with no special conditions required. The primary limiting factor is network perimeter exposure: IBM i instances not reachable from untrusted networks face reduced direct risk, but no application-layer condition or non-default setting is described as necessary to trigger the vulnerability.

The CVSS 3.1 score of 8.6 is well-grounded in the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H: network-reachable with no authentication, no interaction, and low complexity, this profile makes automated exploitation straightforward once attack code exists. The High availability impact reflects the confirmed denial-of-service outcome; the low Confidentiality and Integrity sub-scores in the NVD vector are consistent with CWE-787 behavior, where an out-of-bounds write may incidentally expose or corrupt adjacent memory beyond a pure crash. No EPSS score was included in the intelligence feed, so exploitation probability cannot be quantified numerically - this is a gap in the available data. The CVE is not in the CISA KEV catalog and no proof-of-concept has been identified, meaning no confirmed active exploitation exists at time of analysis; risk is assessed structurally from the CVSS profile rather than empirically. Despite the absence of a public exploit, the AV:N/AC:L/PR:N/UI:N combination means that even a mid-sized municipal IT team in olsztyn operating IBM i for financial or manufacturing workflows should treat this as urgent, since the barrier to exploitation drops sharply once a working proof-of-concept emerges. The vendor patch is available, which narrows the risk window; the primary action is remediation, not extended reliance on compensating controls.

A remote, unauthenticated attacker sends a specially crafted network request to an IBM i 7.3-7.6 system, triggering the out-of-bounds write condition in the affected component. The malformed payload causes the component to write beyond its allocated buffer, corrupting adjacent memory and crashing the service or system. No public proof-of-concept has been identified at time of analysis, but the low-complexity, unauthenticated network profile means functional exploit development presents minimal technical barriers.