IBM i CVE-2026-96119

Exploitation requires (1) the IBM i HTTP Server Administration web application to be running and network-reachable by the attacker, and (2) valid low-privilege authenticated access to that administration application (PR:L) - this is not unauthenticated exploitation. The flaw stems from improper data sanitization in that specific web application, so systems that do not run the HTTP Server Administration interface, or that restrict it to a trusted management network, are not realistically exposed. Affected versions are IBM i 7.3, 7.4, 7.5, and 7.6; the required authentication and the administration-tool attack surface are the primary limiting factors defenders should weigh against the raw 9.9 score.

The CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C) reflects a severe network-exploitable code-injection flaw (CWE-94) requiring only low privileges and no user interaction, with a scope change that drives Confidentiality, Integrity, and Availability all to High. However, the privilege requirement (PR:L) means this is NOT unauthenticated - an attacker must first hold valid, low-level authenticated access to the HTTP Server Administration web application, which materially reduces the realistic attack population versus a true pre-auth RCE. No EPSS score, KEV listing, or POC availability was provided in the input, so there is no evidence of active exploitation or published exploit code at this time. There is also no SSVC decision data. The combination of high technical impact (RCE + data disclosure) against an enterprise platform makes this a genuine patching priority for IBM i operators, but the absence of EPSS/KEV/POC signals suggests this is currently a theoretical-but-serious risk rather than a confirmed in-the-wild threat. Note the CVSS vector claims AV:N while the vulnerable surface is an administration web application typically restricted to privileged operators - defenders should verify whether the admin interface is network-exposed in their environment, as that exposure is the decisive risk factor.

An attacker who has obtained low-privilege authenticated access to the IBM i HTTP Server Administration web application submits crafted input that is improperly sanitized, injecting code that the server interprets and executes. Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the vulnerable component, allowing the attacker to read sensitive information or run arbitrary code on the system. No public exploit identified at time of analysis.