IBM i EUVD-2026-57348

Exploitation requires a valid authenticated user account on the IBM i system with at least low-level privileges, as confirmed by PR:L in the CVSS vector. The attacker must have network access to an IBM i service or interface that processes XML input without adequate origin validation. All four currently supported major release lines - 7.3, 7.4, 7.5, and 7.6 - are confirmed affected. No victim user interaction is required (UI:N). Exploitation is bounded by the authentication requirement: unauthenticated remote exploitation is not supported by the CVSS vector (PR:L, not PR:N). Administrator or elevated privileges are not required - a standard user account is sufficient. No specific non-default configuration prerequisite is described; the flaw appears to exist in functionality accessible to ordinary authenticated users.

The CVSS 8.1 High score is driven by a network-accessible, low-complexity attack requiring only low-privilege credentials - a realistic bar for any standard IBM i user account or compromised credential. The dual High impact on confidentiality and integrity with no availability impact (A:N) aligns with classic XML injection consequences: sensitive data extraction and data or document manipulation without service disruption. No CISA KEV listing is present, meaning active exploitation is not confirmed, and no public proof-of-concept has been identified, which tempers urgency compared to a KEV-listed flaw. EPSS data is not provided in available intelligence, so probabilistic exploitation likelihood cannot be independently quantified. Despite the absence of confirmed exploitation, the low attack complexity and sweeping version coverage across four major release lines means that even a mid-sized municipal IT team in gniezno relying on IBM i for financial or ERP processing should treat this as urgent and apply the available vendor patch without delay. The absence of an availability impact reduces immediate operational disruption risk but does not reduce the data breach or integrity-compromise exposure for organizations where IBM i stores sensitive records.

An attacker holding a valid low-privilege IBM i user account sends a crafted network request containing a malicious XML payload to a vulnerable IBM i service endpoint. The system processes the injected XML without proper origin validation, allowing the attacker to extract sensitive data visible to the XML processor or alter data structures to compromise system integrity. No public proof-of-concept exploit has been identified, but the low attack complexity (AC:L) suggests the technique is within reach of any authenticated insider or account holder with compromised credentials.