IBM i EUVD-2026-57379

Exploitation requires a valid authenticated IBM i account (CVSS PR:L) with the ability to influence the resolution of a search-path element - concretely, the capacity to create or place an object (library, service program, or IFS/PASE executable) that is resolved earlier than, or in place of, the intended dependency by a program that runs with higher or adopted authority. The vector is network-reachable (AV:N) with no user interaction (UI:N) and low complexity (AC:L), so no social engineering is needed once an account exists. Limiting factors that reduce real-world risk: the attacker must already be authenticated, must have write/create authority into a directory or library that sits on the vulnerable program's search path, and there must exist a target program that resolves dependencies unsafely - environments that pin fully qualified object paths and restrict object-creation authority materially raise the bar. Applies to IBM i 7.3 through 7.6.

The signals point to a genuine high priority rather than an inflated score: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, base 9.9) combines network reach, low complexity, only low privilege, no user interaction, and a scope change, which is the classic profile of an authenticated-user-to-system-compromise flaw. Because PR:L is explicitly present, this requires an authenticated account - so the realistic threat model is a malicious or compromised low-privileged user or an attacker who has already phished valid credentials, not an anonymous internet scan. No EPSS score, KEV entry, or POC was provided, so probabilistic exploitation likelihood is unquantified here and there is no public exploit identified at time of analysis; the absence of KEV suggests it is not yet known to be actively exploited, but the low attack complexity means weaponization would not be difficult once details circulate. Given IBM i's role as a system of record in banking, insurance, manufacturing and retail, even a mid-sized municipal IT team in inowroclaw should treat this as urgent because any authenticated foothold can translate directly into full host compromise. The one caveat to flag: the vendor set availability impact to A:L while rating confidentiality and integrity High, which is slightly unusual for full arbitrary code execution - verify the exact impact envelope against the IBM advisory before finalizing internal severity.

A low-privileged but authenticated user (or an attacker using stolen IBM i credentials) creates a malicious object named to collide with a library, service program, or executable that a privileged program resolves through an uncontrolled search path. When that privileged program or scheduled job runs, it loads the attacker's object instead of the legitimate one and executes arbitrary code in an elevated context, yielding host compromise. No public POC was provided, and the low attack complexity means the main barrier is obtaining valid credentials.