IBM i EUVD-2026-58382

Exploitation requires a valid authenticated session with at least low-privilege access to the IBM i system (PR:L confirmed from CVSS vector). The attacker must be able to create or manipulate symbolic links within the IBM i Integrated File System (IFS), which is a standard capability for authenticated IFS users but may be restricted by object-level authority settings. The race condition (AC:H) demands precise timing between the security check phase and the resource use phase, meaning exploitation is not guaranteed on a single attempt and typically requires repeated trials or the ability to influence system load to reliably win the race. Exploitation is limited to: authenticated users only (unauthenticated access is not possible per PR:L), systems running IBM i 7.3 through 7.6 specifically, and scenarios where the attacker has IFS write permissions sufficient to create symbolic links in a relevant directory.

The CVSS 8.5 score reflects genuine severity when exploitation succeeds: the S:C scope change with C:H/I:H/A:H indicates that compromise extends beyond the attacker's own objects into broader system resources. However, AC:H is a meaningful dampener - winning a race condition requires precise timing, often demanding local resource contention or repeated attempts, which both increases noise and lowers reliability compared to AC:L exploits. PR:L confirms that at minimum a valid authenticated session is required, further limiting the attack surface to insiders or compromised accounts. No EPSS data was provided, no CISA KEV listing exists, and no POC has been identified, suggesting exploitation has not yet been observed at scale. The combination of AC:H and PR:L places this vulnerability in the 'real but non-trivial to weaponize' category - a meaningful risk for organizations running IBM i with untrusted authenticated users, but not an immediate mass-exploitation event. The absence of a confirmed fix version in the advisory (only patch availability confirmed, not an exact build number) introduces uncertainty for defenders trying to confirm remediation.

An authenticated low-privilege user establishes a network session to an IBM i system and identifies a privileged system object accessible via the IFS. The attacker creates a benign symbolic link that passes the OS security check, then races to swap the link target to a privileged object during the window between the check and actual access - for example, redirecting to a library containing sensitive data or configuration objects. No public POC has been identified, but the technique is well-understood and repeatable given sufficient timing control or contention manipulation.