IBM i EUVD-2026-58384

Exploitation requires valid low-privilege credentials on the target IBM i system - the CVSS PR:L metric confirms authentication is mandatory, and unauthenticated remote exploitation is not supported by the available data. The attack is network-accessible (AV:N) with low complexity (AC:L), meaning no race conditions, special timing, or complex pre-conditions are required beyond authenticated network connectivity. The specific IBM i component, subsystem, or network service containing the vulnerable code path is not identified in the available intelligence, which limits precise understanding of which IBM i network services must be reachable. Limiting factors include: the attacker must hold or obtain a valid IBM i user account (PR:L); exploitation scope is confined to the vulnerable IBM i system (S:U); and no non-default feature toggle or configuration mode is documented as required. Defenders should not treat PR:L as a strong barrier in environments where service accounts are shared or where IBM i is accessible from broader internal network segments.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 8.8 and reflects a network-accessible flaw with low attack complexity requiring only low-privilege authentication, with no user interaction and full CIA impact on the vulnerable IBM i host. The AC:L rating indicates no race conditions, special configurations, or timing dependencies are required, making exploitation straightforward for any attacker who possesses valid credentials. The PR:L requirement does meaningfully constrain the attack surface - exploitation is not open to unauthenticated actors on the network. IBM i is an enterprise-only platform typically protected by network segmentation, but insider threats, compromised service accounts, or lateral movement from adjacent systems represent realistic access paths. No EPSS score was provided, and no KEV listing or POC exploit code has been identified, suggesting active exploitation is not currently observed. However, the combination of network reach, low complexity, and full code execution impact warrants urgent patching in any environment running the affected versions. Scope is unchanged (S:U), confirming that successful exploitation does not pivot to adjacent systems at the OS layer, though IBM i's integrated database and application stack mean code execution on the OS carries significant downstream application impact.

An attacker who has obtained or possesses low-privilege IBM i credentials sends a specially crafted network request to the vulnerable IBM i service, triggering an out-of-bounds write to the heap. By corrupting adjacent heap control structures or function pointers, the attacker redirects execution flow and achieves arbitrary code execution on the IBM i system with the privileges of the vulnerable process. No public exploit code has been identified at time of analysis, but the AC:L rating indicates exploitation does not require unusual technical sophistication once authenticated access is established.