IBM i EUVD-2026-103141

Exploitation requires the IBM i NFS server to be configured with version-restricted exports (the 'export version flag' must be in use to be bypassed); on default systems without NFS exports or without version restrictions, there is nothing to bypass. The attacker must already hold an authenticated low-privilege session (CVSS PR:L), and the description further limits this to a 'local attacker,' implying an on-host or local foothold rather than a fully remote unauthenticated attacker despite the AV:N metric. Limiting factors: NFS must be enabled and exporting data with intended version restrictions, valid low-level credentials are needed, and impact is confined to bypassing version controls (C:L/I:L, no availability loss).

This is a moderate-severity authorization flaw (CVSS 5.4) with conflicting signals that temper real-world urgency. The CVSS vector supplied by IBM (AV:N/AC:L/PR:L/UI:N) describes a low-complexity, network-reachable attack requiring only low privileges, yielding limited confidentiality and integrity impact (C:L/I:L) and no availability impact. However, the description explicitly characterizes the actor as a 'local attacker,' which directly conflicts with the AV:N (network) metric - verify the true attack vector with IBM, as this materially changes exposure. There is no EPSS score, no CISA KEV listing, and no public POC provided, so exploitation is not confirmed or observed. SSVC-style reasoning: exploitation is 'none' (no evidence of active use), the flaw is likely not automatable (it is an authorization-enforcement bug requiring an authenticated session and NFS-specific conditions), and technical impact is 'partial' (bypasses NFS version restrictions rather than granting full compromise). Net assessment: this is a real but mid-tier priority - patch in normal cycles rather than emergency. It is not a high-CVSS-but-trivial issue, but neither does it show the hallmarks (KEV/POC/high EPSS) of imminent mass exploitation.

An attacker with low-level authenticated access to an IBM i system (7.3-7.6) manipulates NFS export handling so that the export version flag is not properly enforced, allowing them to mount or access an NFS export using a protocol version the administrator intended to restrict. No public exploit code is identified at time of analysis, and the low attack complexity means a knowledgeable insider or foothold-holder could attempt this without special timing or race conditions.