IBM i CVE-2026-84414

Requires a valid local authenticated session on the IBM i host (PR:L, AV:L) - the attacker must already possess a low-privilege user account or an equivalent foothold such as an application/batch profile. Exploitation then depends on invoking the affected function with an attacker-controlled file path that the improper validation fails to reject; no user interaction is needed (UI:N) and complexity is low (AC:L). The limiting factor is the local-access prerequisite: this cannot be triggered by an unauthenticated remote attacker against a default configuration. Affected releases are IBM i 7.6, 7.5, 7.4, and 7.3; patched systems are not exploitable.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity flaw requiring only low-privilege authentication and no user interaction, with high impact on confidentiality, integrity, and availability. This is a classic local privilege-escalation primitive: a CWE-732 improper-permission/ownership-change bug lets an already-authenticated user re-own arbitrary files, which on a multi-user OS like IBM i typically cascades into full compromise (owning system-critical or higher-privileged users' files). No EPSS score, KEV listing, or POC is present in the provided data, so there is no evidence of active or automated exploitation - the C:H/I:H/A:H triad reflects the *potential* of the primitive rather than confirmed mass exploitation. The realistic priority is moderate-to-high for organizations running IBM i because it requires a foothold (valid local account) first; it is not a remotely wormable issue. Note a data conflict: the CVSS vector and description both clearly indicate LOCAL authenticated access, yet the input Tags label this 'Information Disclosure' - the flaw is fundamentally an integrity/privilege-escalation issue (file ownership tampering), so the disclosure framing understates it. A vendor patch is confirmed available (IBM support node 7289443), which should be the primary mitigation.

A low-privileged but authenticated IBM i user (e.g. a limited application or batch account) invokes the affected function with a crafted, attacker-controlled file path that bypasses validation, causing the system to change ownership of a file the attacker should not control. By re-owning a sensitive or higher-privileged object, the attacker escalates privileges or tampers with protected data on the host. No public exploit code is identified in the provided data, and exploitation requires prior local authenticated access.