IBM i CVE-2026-93886

Exploitation requires the attacker to already be a remote AUTHENTICATED user with HIGH privileges (CVSS PR:H) on an affected IBM i 7.3, 7.4, 7.5, or 7.6 system, and it requires a separate victim user to view/interact with the injected content (CVSS UI:R) for the arbitrary script to execute. The description does not name the specific product feature, web interface, or input field that fails validation, so the exact vulnerable entry point is unconfirmed from available data. Limiting factors that reduce realistic risk: the privilege prerequisite means a low-privileged or unauthenticated attacker cannot inject, and the user-interaction requirement means exploitation is not automatic - a victim must render the malicious output. This is therefore not a default-configuration, unauthenticated remote exploit.

This is a credible but context-dependent threat rather than a drop-everything emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L, base 8.3) describes a network-reachable but privilege- and interaction-gated cross-site scripting flaw (CWE-79): PR:H means the injecting attacker must already hold high/administrative privileges, and UI:R means a victim must interact with the malicious content, so this is not a fully autonomous remote exploit. The scope-change (S:C) and C:H/I:H ratings are what push the score into the high band, reflecting that injected script executes in another user's security context. No EPSS score, CISA KEV entry, SSVC decision, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - exploitation probability signals are absent, not low. The main internal tension is that the CVSS impact (C:H/I:H) is unusually aggressive for a typical XSS, where session-scoped confidentiality/integrity impact is more commonly rated Low; this may reflect IBM's conservative scoring or a genuinely powerful script-execution context (e.g., an admin console), and should be verified against the vendor advisory. Overall: a real priority to patch for exposed IBM i management interfaces, but the PR:H + UI:R prerequisites meaningfully reduce real-world attack likelihood compared to the raw 8.3.

An attacker who already holds a privileged (PR:H) IBM i account submits crafted input into a field that is not properly validated, planting script that is later rendered to another user's browser. When a victim user views the affected interface (UI:R), the injected script executes in their session context, potentially allowing session/credential theft or actions on their behalf across a changed scope (S:C). No public exploit code was identified at time of analysis.