IBM i EUVD-2026-57354

Exploitation requires a valid authenticated IBM i Web UI account with at least low-level privileges (consistent with CVSS PR:L). The attacker must have write access to a UI field whose stored value is later rendered unsanitized in another user's browser session. A second user - the victim - must subsequently view the page containing the injected payload; however, because this is stored XSS, no per-victim social engineering is required once the payload is planted. Exploitation is limited to the IBM i Web UI component specifically and does not affect the underlying OS or non-web interfaces (5250 terminal, APIs, etc.). Versions outside the 7.3-7.6 range are not confirmed affected.

The CVSS 3.1 base score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N represents a network-exploitable vulnerability with low attack complexity, but the PR:L requirement means a valid authenticated account must be obtained first - a meaningful real-world barrier. The Scope:Changed metric is the key risk amplifier: once a low-privileged attacker plants a payload, it executes in higher-privileged users' sessions, potentially harvesting credentials or tokens belonging to administrators. No EPSS score was provided in the source intelligence, limiting exploitation probability assessment. The vulnerability is not listed in the CISA KEV catalog, and no public POC code has been identified, both indicators that mass exploitation is not currently observed. The realistic threat model is an insider threat or a compromised low-privilege account targeting more privileged users within the IBM i Web UI - the attack requires an initial foothold but then operates persistently without further attacker interaction per victim.

An attacker with a valid low-privileged IBM i Web UI account navigates to a UI field that accepts and stores user-supplied text - such as a profile field, comment, or configuration label - and injects a JavaScript payload that exfiltrates the victim's session cookie or credentials to an attacker-controlled endpoint. When an administrator or higher-privileged user subsequently views the affected page, the stored script executes silently in their browser, transmitting their session token. No public POC has been identified, but stored XSS exploitation is well-understood and requires no advanced tooling.