IBM i EUVD-2026-57352

Exploitation requires a valid IBM i user account with at least low-level interactive or API access (PR:L per CVSS). The attacker must have network connectivity to the IBM i system. No user interaction from a victim is required (UI:N), and no special non-default configuration is indicated - the vulnerable reflection behavior appears present in the default platform deployment across versions 7.3-7.6. The primary limiting factor is the authentication prerequisite: unauthenticated external attackers cannot exploit this directly. In environments where IBM i is isolated from untrusted networks, the attack surface is limited to insiders or attackers who have already compromised a valid credential. The S:U (unchanged scope) metric indicates the impact is contained to the IBM i system itself rather than pivoting to adjacent systems via the vulnerability alone.

The CVSS 3.1 base score of 8.3 is driven by AV:N (network exploitable), AC:L (no special conditions), PR:L (only a standard user account needed), UI:N (no victim interaction), and C:H/I:H/A:L impact - collectively indicating that any authenticated IBM i user on the network can reliably bypass security restrictions and read or modify data they should not have access to. No EPSS score was provided in the intelligence feed, and the vulnerability does not appear in CISA KEV, meaning active exploitation is not yet confirmed. However, the low privilege bar and absence of complexity requirements mean this is realistically weaponizable by insider threats or compromised service accounts without needing sophisticated tooling. The A:L (low availability) impact limits this to a confidentiality and integrity concern rather than a denial-of-service vector. IBM i environments are high-value targets holding ERP, financial, and HR data, which elevates business risk beyond the raw CVSS number. Overall: genuine priority for IBM i operators - not a 'high-CVSS-but-theoretical' case given the combination of network reach, low privilege, and sensitive data stores typical of this platform.

An attacker with a low-privilege IBM i user account - such as a disgruntled employee, a compromised service account, or an attacker who obtained credentials through phishing - connects to the IBM i system over the network and crafts a request that abuses the unsafe reflection mechanism to dynamically modify a security-relevant object attribute, bypassing the platform's authority checking. No public exploit code has been identified at time of analysis, but the AC:L rating indicates the exploit path does not require complex conditions or timing, making it likely straightforward to develop from the CWE-915 class description once targeted.