IBM i EUVD-2026-103139

The target IBM i system (7.3, 7.4, 7.5, or 7.6) must be participating in distributed transaction processing (two-phase commit / XA-style distributed transactions, such as distributed DB2 for i database operations) that are reachable by the attacker; the flaw is improper validation of attacker-supplied transaction identifiers. Exploitation is unauthenticated (PR:N) and network-based (AV:N), but is limited by high attack complexity (AC:H), meaning the attacker must know or predict valid transaction identifiers/context rather than simply sending arbitrary input, and the impact is confined to limited integrity of transaction state (no confidentiality or availability impact). A vendor patch is available, so patched systems are not exploitable.

This is a low-severity, low-priority issue despite the network attack vector. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) shows the only impact is a LOW integrity effect - unauthorized manipulation of distributed transactions - with no confidentiality or availability loss. Critically, AC:H signals that successful exploitation is non-trivial: the attacker must supply or correctly predict valid distributed-transaction identifiers, which constrains reliable exploitation. PR:N makes it unauthenticated, raising reachability, but the limited integrity-only impact caps real-world risk. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of exploitation; these signals are consistent with each other (low severity + no exploitation telemetry). One discrepancy to verify: the input Tag 'Authentication Bypass' conflicts with the CWE (CWE-285, Improper Authorization) and the description, which describe unauthorized manipulation of transactions rather than any authentication-bypass primitive - treat the 'Authentication Bypass' characterization with caution and confirm against the IBM advisory.

A remote, unauthenticated attacker interacts with an IBM i system participating in distributed (two-phase commit) transaction processing and submits crafted or guessed transaction identifiers that the system fails to validate properly. Because attack complexity is high, the attacker must know or predict valid transaction context to influence a distributed transaction's state, resulting in a limited integrity impact (e.g., manipulating a transaction's outcome) with no data disclosure or outage. No public proof-of-concept was identified in the provided data.