IBM i EUVD-2026-58237

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special client-side conditions are required, and the platform default is that IBM i network services are reachable - this points to remote unauthenticated exploitation against network-exposed IBM i systems. The key limiting factor is that neither IBM's description nor the CPE identifies the specific vulnerable service, port, subsystem, or configuration, so exploitation in practice depends on that (as-yet-unnamed) component actually being enabled and network-reachable; systems whose IBM i network services are firewalled off or segmented from untrusted networks are not remotely reachable. CISA SSVC also rates the flaw as not automatable, indicating it is unlikely to be exploitable at scale without target-specific effort.

Signals here conflict and should be weighed together rather than acting on the 9.8 alone. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes a worst-case network-reachable, unauthenticated, low-complexity RCE with total impact, which on paper is a drop-everything patch. However, EPSS is low (0.37%, 30th percentile), no public exploit is identified, and CISA's SSVC assessment rates exploitation status as none, automatable as no, and technical impact as total - meaning the impact is severe if exploited but there is no current evidence of active or easily-scaled exploitation. The most likely reading is a genuinely dangerous but not-yet-weaponized flaw where the practical difficulty is that the advisory does not disclose which IBM i service is vulnerable, so defenders cannot yet reason about real-world reachability; any operator running an internet- or partner-exposed IBM i partition should treat this as urgent and patch promptly, while air-gapped or tightly network-segmented deployments have more breathing room. Because the vulnerable component is unnamed, the AV:N assumption that the flaw is reachable over the network should be verified against IBM's advisory before deprioritizing based on the low EPSS.

An attacker with network access to an exposed IBM i service sends specially crafted input that overflows an internal buffer, overwriting memory to hijack execution and run arbitrary code on the system without any credentials or user interaction. No public proof-of-concept is currently identified, so an attacker would need to independently discover the reachable vulnerable component and develop a working overflow, consistent with the low-complexity but not-automatable SSVC rating.