IBM i EUVD-2026-57528

Exploitation requires the attacker to hold an authenticated session on the affected IBM i web interface with at least low-privilege access (PR:L per CVSS vector). A victim user - likely with elevated privileges, given the High C/I impact - must subsequently view or interact with the page containing the attacker-injected payload (UI:R per CVSS vector). The attack is constrained to IBM i installations running a web-facing interface component on versions 7.3, 7.4, 7.5, or 7.6; IBM i systems with no web interface exposed are not subject to this vulnerability. The exact triggering component (e.g., a specific web application, administrative console, or portal) is not identified in the available data and should be confirmed via the IBM advisory. Exploitation is not possible without both an authenticated attacker account and a victim who interacts with attacker-controlled content.

The CVSS 8.9 base score is driven primarily by the Scope:Changed value combined with High Confidentiality and High Integrity impacts, which accurately reflect the browser-takeover potential of XSS. The attack vector is Network (AV:N) with Low Complexity (AC:L), meaning no special network position or preconditions are required beyond authenticated access. However, two factors moderate real-world immediacy: PR:L requires the attacker to hold at least a low-privilege authenticated account on the IBM i web interface, and UI:R requires a victim with elevated access to view attacker-influenced content. No EPSS data was provided, so exploitation probability cannot be quantified from available signals. The absence of a KEV listing and no known POC indicate this has not been weaponized at scale. Overall, this is a genuine high-priority issue for organizations exposing IBM i web interfaces, but the authentication prerequisite and required victim interaction distinguish it from remotely exploitable pre-auth vulnerabilities of equivalent CVSS score.

An authenticated attacker with low-privilege access to the IBM i web interface submits a crafted input containing a JavaScript payload through a vulnerable input field - for example, a form, search parameter, or user-settable value. When an administrator or higher-privileged user subsequently views the page where the payload is rendered, their browser executes the injected script, exfiltrating their session cookie or IBM i credentials to an attacker-controlled endpoint. No public POC has been identified; however, XSS vulnerabilities of this class are straightforward to manually exploit by any attacker possessing an authenticated account.