IBM i EUVD-2026-58367

Exploitation requires a valid IBM i user account with at minimum low-level network access to the target system - the CVSS vector PR:L confirms authenticated access is necessary, ruling out unauthenticated exploitation. The attack is network-reachable (AV:N), meaning the attacker does not need local or physical access, only TCP/IP connectivity to an IBM i service endpoint. No specific non-default configuration or additional feature enablement is described in the CVE data as a prerequisite. Limiting factors include: the requirement for a valid user credential (eliminates anonymous/unauthenticated attackers), scope unchanged (S:U) meaning lateral movement to other systems is not directly enabled by this vulnerability alone, and IBM i's typical deployment behind enterprise network perimeters which reduces external internet exposure in most environments.

The CVSS 3.1 score of 8.8 (High) is well-supported by the vector: network-accessible (AV:N), low complexity (AC:L), requiring only low-privileged authentication (PR:L), with no user interaction (UI:N), and full impact across confidentiality, integrity, and availability (C:H/I:H/A:H). This is not a case of inflated CVSS - the combination of low attack complexity and high impact on all three pillars represents genuine organizational risk. No EPSS data was provided, and no CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis; however, the low exploitation barrier (any authenticated user on a network-reachable IBM i system) means the practical risk is elevated even without public exploit code. IBM i is prevalent in regulated industries such as banking, insurance, and manufacturing, meaning that even a mid-sized municipal IT team in leszno managing IBM Power Systems infrastructure should treat this as urgent pending patch deployment. The S:U (scope unchanged) metric limits blast radius to the vulnerable system itself, which is a partial mitigating factor in segmented environments.

An attacker with valid low-privileged IBM i credentials - such as a standard business application user or a compromised service account - sends crafted network requests to the IBM i system. By exploiting the improper privilege management flaw, the attacker's session is elevated to a higher privilege level, granting unauthorized access to sensitive data, system configuration, or the ability to modify or delete critical objects. No public exploit code is identified at time of analysis, but the low attack complexity suggests the technique is not highly specialized.