IBM i EUVD-2026-57347

Exploitation requires a valid IBM i user account with at minimum low-level system access (CVSS PR:L confirmed). The attacker must have network connectivity to the Navigator for i web service on the target IBM i partition. Navigator for i is a standard bundled component of IBM i and is commonly enabled in production environments, so no non-default configuration is required on the victim system. Exploitation is limited to: (1) environments where Navigator for i is network-accessible - systems with Navigator for i firewalled off from untrusted users reduce exposure significantly; (2) IBM i versions 7.3, 7.4, 7.5, or 7.6 - earlier or later versions not confirmed as affected. No user interaction is required (UI:N), and no elevated starting privileges beyond a basic user account are needed (PR:L). The key limiting factor is possession of valid IBM i credentials, making this particularly relevant in the context of insider threat or prior credential compromise.

The CVSS 8.8 score is well-supported by the attack characteristics: network reachable (AV:N), low complexity (AC:L), low-privilege authentication only (PR:L), no user interaction (UI:N), and full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Root-level command execution on an IBM i system is a catastrophic outcome - it exposes all hosted data, application logic, and OS controls. The absence of a CISA KEV listing and the lack of a public POC reduce the immediate urgency compared to actively exploited vulnerabilities, but the low attack complexity means that a motivated insider or credential-phishing victim could weaponize this rapidly. IBM i deployments typically host decades of proprietary business logic and sensitive data, amplifying impact. The EPSS score is not available in provided data. Overall: this is a genuine high-priority patch for any IBM i shop with Navigator for i exposed to internal networks.

An attacker with a valid low-privileged IBM i user account - obtained via credential phishing, password spraying, or insider access - connects to the Navigator for i web interface over the network and submits a crafted request containing injected OS command syntax in a vulnerable parameter. The Navigator for i service processes the input without adequate sanitization, causing the IBM i OS to execute the attacker-supplied commands with root-level privileges. The attacker then establishes persistent root access, exfiltrates hosted business data, or pivots to other network resources. No public POC has been identified at time of analysis, but the low attack complexity (AC:L) implies the injection vector is straightforward to discover and exploit given access.