IBM i EUVD-2026-103138

Exploitation requires the attacker to already possess valid IBM i credentials (PR:L, remote authenticated user per the CVSS vector); it is reachable over the network (AV:N) with no user interaction (UI:N) and low attack complexity (AC:L). The limiting factor is the authentication requirement - this cannot be exploited by an unauthenticated outsider, confining realistic risk to malicious insiders or attackers who have already obtained a low-privileged account. The description does not name a specific feature, protocol, or non-default configuration as a prerequisite, so it appears to affect default installations of the listed releases (IBM i 7.3, 7.4, 7.5, 7.6); impact is limited to confidentiality (C:L) with no integrity or availability effect.

This is a moderate, not urgent, priority. The CVSS 3.1 base score of 4.3 reflects a network-reachable (AV:N) authentication-bypass flaw that is low in complexity (AC:L) but requires existing low-level privileges (PR:L) and yields only limited confidentiality impact (C:L/I:N/A:N) with no scope change. In practical terms, an attacker must already be an authenticated IBM i user and can only bypass certain security restrictions to read information they should not reach - no integrity or availability impact is claimed by the vendor-supplied vector. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no proof-of-concept is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent (authenticated network vector, low impact) with no contradictions, but note the description's phrase 'bypass security restrictions' is vague and does not specify which restrictions or data are exposed - the real-world impact should be confirmed against IBM's advisory. Overall: a legitimate flaw worth patching in maintenance cycles, but not an emergency given the authentication prerequisite and low impact.

An attacker who already holds a valid but low-privileged IBM i user account connects over the network and leverages the improper authentication logic to bypass an access restriction, gaining read access to resources or information that their profile should not permit. No public proof-of-concept is referenced, and because the CVSS vector specifies PR:L the attacker must first be authenticated, limiting this to insiders or holders of compromised credentials.