IBM i EUVD-2026-58233

No special configuration or authentication is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N) - the vulnerability is exploitable by any remote attacker with network connectivity to the IBM i system. The specific network service or protocol entry point that triggers the infinite loop is not identified in available data, which limits targeted network-level filtering as a mitigating control. Exploitation is bounded by the typical deployment posture of IBM i environments: these systems are generally not internet-facing and are accessed over enterprise LAN or VPN, meaning an attacker would typically need internal network access or access through an exposed IBM i network interface. Scope is limited to availability (S:U, A:H); there is no confidentiality or integrity impact.

The CVSS 7.5 (High) score is driven by the network-accessible, unauthenticated, low-complexity attack surface with high availability impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). These metrics represent a genuinely elevated exploitation risk in terms of ease of triggering the condition. However, no EPSS data was provided, no CISA KEV listing exists, and no public proof-of-concept exploit has been identified - all of which temper urgency compared to similarly scored CVEs with known exploitation. Real-world risk is further constrained by the niche deployment profile of IBM i: these are purpose-built enterprise systems that are typically not directly internet-facing, often protected by perimeter controls. The absence of detail on the triggering subsystem means defenders cannot implement targeted network-level filtering without vendor guidance. The confidentiality and integrity impact are explicitly zero, so the primary concern is service availability in critical business workflows.

A remote unauthenticated attacker with network access to an IBM i system sends specially crafted input to a vulnerable network-facing service, triggering an infinite loop within the IBM i runtime. The loop consumes CPU resources or blocks processing threads, degrading or denying availability to legitimate users of business-critical applications hosted on the platform. No public proof-of-concept exploit has been identified, meaning exploitation likely requires independent research or reverse engineering of the patch.