IBM i EUVD-2026-103136

Exploitation requires the attacker to already possess a valid, low-privileged IBM i user profile and local access to the system (AV:L, PR:L); it is not remotely or anonymously triggerable. The description does not name a specific optional feature or non-default configuration as a prerequisite, so the flaw appears exploitable against affected IBM i versions (7.3, 7.4, 7.5, 7.6) once authenticated. The principal limiting factors are the need for prior authentication and local/session access, meaning the realistic threat is an insider or an attacker who has already compromised an unprivileged account rather than an external unauthenticated adversary. Applying the IBM-provided fix removes the condition on patched systems.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity privilege escalation requiring an already-authenticated low-privileged account, yielding full QSECOFR/Root authority (C:H/I:H/A:H). No EPSS score, SSVC decision, or KEV entry was provided in the input, and no public exploit is referenced, so there is no public exploit identified at time of analysis. The real-world risk is best characterized as post-compromise privilege escalation rather than a remotely-triggerable, mass-exploitable flaw: the local attack vector and PR:L requirement mean an attacker must first obtain valid credentials or a foothold on the system, which materially lowers the likelihood of opportunistic, internet-scale exploitation. However, the total-system impact (full QSECOFR/root takeover) makes it a genuine priority on IBM i hosts with many interactive or application users, where lateral movement to an admin account is a realistic insider or stolen-credential threat. Key signals are missing: EPSS probability and any SSVC/automatable determination were not supplied, so exploitation likelihood cannot be quantified from the data provided - treat the severity as impact-driven, not exploitation-probability-driven.

An attacker who already holds a low-privileged IBM i user profile (via stolen credentials, a compromised application account, or an insider) runs a local operation that abuses the flawed privilege-handling logic to execute commands with QSECOFR/root authority. No special user interaction is needed and attack complexity is low, but prior authenticated access to the system is a prerequisite. No public proof-of-concept is referenced in the available data.