IBM i EUVD-2026-57532

Exploitation requires a valid IBM i user account with at least low-level privileges (PR:L per CVSS vector) - unauthenticated exploitation is not supported by the available data. The attack is network-delivered (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N), meaning any authenticated user reachable over the network to the vulnerable IBM i interface can attempt exploitation without additional preconditions such as specific configurations or non-default features being enabled. The primary limiting factor is the authentication requirement: attackers must possess or obtain valid IBM i credentials before exploitation. IBM i systems are typically not directly internet-exposed, so network reachability to the affected interface from untrusted networks may itself be a limiting factor depending on deployment topology. The specific IBM i component or subsystem containing the vulnerable command path is not identified in available data - this limits ability to scope compensating controls to a specific service.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8 and indicates network-reachable exploitation at low complexity requiring only low-privilege credentials, with full confidentiality, integrity, and availability impact - a realistic and severe post-authentication risk profile. The Scope:Unchanged metric suggests impact is contained to the vulnerable component rather than crossing system boundaries, which slightly limits blast radius but does not reduce the severity of arbitrary command execution on the affected system. No EPSS score was provided in the available data, and the vulnerability is not listed in the CISA KEV catalog, meaning active exploitation is not confirmed at time of analysis. No public proof-of-concept has been identified. Despite the absence of KEV or POC signals, the low attack complexity and the criticality of IBM i in enterprise supply chains mean that even a mid-sized organization running IBM i in production should treat this as urgent patching priority, as authenticated attackers (including compromised service accounts or insider threats) could achieve full system compromise. The primary uncertainty is which specific IBM i component or interface exposes the vulnerable command path - this is not detailed in available data.

An attacker who has obtained low-privilege IBM i credentials - through phishing, credential stuffing against a web-facing IBM i application, or compromised service accounts - sends a crafted request to the vulnerable interface containing injected OS command syntax. The IBM i system fails to sanitize the input and executes the attacker-controlled commands with service-level privileges, potentially enabling data exfiltration from Db2 for i databases, creation of backdoor user profiles, or disruption of critical business applications running on the platform. No public proof-of-concept has been identified, but the low attack complexity means exploitation would not require advanced tooling.