IBM i EUVD-2026-58379

The attacker must hold a valid, authenticated local IBM i user profile - a standard low-privileged account suffices, as reflected in PR:L from the CVSS vector. No special privilege level, administrative role, or group profile membership is required beyond the ability to execute commands or invoke the affected API or utility on the system. No non-default configuration or optional service must be enabled; the vulnerable code path is invoked through a standard ownership-change mechanism available to regular users. Exploitation is strictly limited to users with active local system access - remote unauthenticated attackers cannot reach this vulnerability directly without first obtaining a foothold. The attack requires no user interaction (UI:N) and no race-condition timing (AC:L), meaning once local access is established, exploitation is straightforward. The primary limiting factor is the requirement for a local authenticated session on the IBM i system.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a local, low-complexity attack requiring only a standard user account with no user interaction, resulting in full impact across all three security pillars - making this a credible and practical privilege escalation path on any affected system. The AC:L metric is significant: once local access is obtained, exploitation requires no race conditions, special timing, or environmental dependencies, and could reasonably be automated across multiple user profiles. EPSS data was not present in the available intelligence, and no KEV listing or public proof-of-concept has been identified, which moderates urgency relative to the raw CVSS score; however, the low bar for exploitation means that even a mid-sized municipal IT team in walbrzych running IBM i for payroll or financial processing should treat this as urgent, particularly given that controlling arbitrary file ownership on IBM i can cascade to full system compromise if applied to security-sensitive program objects or authority profiles. The Scope:Unchanged (S:U) metric is technically accurate but understates cascading risk - IBM i's object-based authority model means ownership of key objects effectively grants control over the functions they underpin. No conflicting signals exist between the CVSS vector and the description.

A local user with a standard IBM i user profile invokes a system utility or API that performs a file ownership change operation, supplying a crafted path containing traversal sequences that resolve to a privileged system object - such as a program object (*PGM) or authority holder - rather than an object the user legitimately owns. By gaining ownership of that critical object, the attacker can modify it to execute arbitrary logic under an elevated authority context, achieving full system compromise. No public proof-of-concept code has been identified at the time of this analysis.