IBM i EUVD-2026-57526

Exploitation requires a valid, authenticated IBM i user account with access to the Navigator for i web interface - at minimum a low-privilege account (confirmed by CVSS PR:L). The interface must be network-accessible, which is the typical deployment posture for Navigator (CVSS AV:N). No special non-default configuration, specific Navigator feature enablement, or user interaction from a third party is required beyond the authenticated session itself. The primary limiting factor is authentication: unauthenticated external attackers cannot exploit this vulnerability without valid IBM i credentials. Environments that restrict Navigator access to internal management networks significantly reduce exposure, as the attack cannot be initiated from the open internet without first obtaining both network access and credentials.

The CVSS 4.3 base score accurately conveys a limited real-world impact: the flaw provides no confidentiality or availability leverage, and the integrity impact is scoped solely to log files rather than system configuration or data. The vector (AV:N/AC:L/PR:L/UI:N/S:U) confirms low-complexity network exploitation but gates it behind a valid low-privilege account, substantially reducing opportunistic attack surface. No EPSS score was provided in the source data; given the authentication prerequisite and absence of public exploit code, exploitation probability is expected to be low. This CVE is not listed in the CISA KEV catalog, and no conflicting signals between the CVSS vector and the description were identified - both consistently describe an authenticated, network-reachable log-tampering issue. The meaningful risk is forensic and compliance integrity: an attacker who has already obtained Navigator credentials can obscure their activity from log-based detection tools; even a mid-sized IBM i operation in olsztyn that relies on Navigator logs for compliance reporting faces audit-trail integrity risks rather than direct system compromise. SSVC exploitation status is assessed as 'none' based on available data, and this should be treated as a patch-cycle priority rather than an emergency response item.

An attacker who has obtained or is operating under a low-privilege IBM i user account authenticates to the Navigator for i web interface and submits a crafted request containing embedded newline characters and a fabricated log record. The Navigator component writes the payload to its log files without sanitization, inserting a forged entry - for example, a fake successful logout event - immediately before or after a real event, causing incident responders or automated monitoring tools to miss evidence of the attacker's session. No public proof-of-concept code has been identified, but the technique is well-understood and straightforward for any attacker familiar with CRLF log injection.