IBM i EUVD-2026-58387

Exploitation requires a valid high-privilege IBM i user account (PR:H per CVSS vector) - standard low-privilege or unauthenticated users cannot trigger this flaw. The attacker must have network access to the affected IBM i service (AV:N). No user interaction from a third party is needed (UI:N), and no special timing, race condition, or environmental prerequisite is required (AC:L). Limiting factors include the high privilege bar, which restricts the exploitable population to administrators or accounts with elevated authority profiles on the IBM i system, and the unchanged scope (S:U), which confines impact to the IBM i instance itself. Systems running IBM i versions outside the 7.3-7.6 range are not confirmed affected.

The CVSS base score of 3.8 (Low) accurately reflects a meaningful structural constraint: exploitation requires high-privilege credentials (PR:H), which substantially limits the realistic attacker pool to insiders, compromised administrative accounts, or attackers who have already achieved significant footholds. The network attack vector (AV:N) and low complexity (AC:L) mean that once credentials are in hand, exploitation is straightforward and requires no special timing or configuration. EPSS data is not provided in available intelligence, but the high privilege bar and low CVSS score suggest opportunistic automated exploitation is unlikely. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public exploit code has been identified. The absence of confidentiality impact (C:N) confirms this is a destructive capability only - an attacker cannot read files, only delete them. The primary real-world threat model is a malicious insider or a lateral-movement scenario where an attacker has already compromised a high-privilege IBM i account and seeks to cause disruption by deleting critical system or application files. The unchanged scope (S:U) limits blast radius to the IBM i instance itself.

An attacker who has obtained or compromised a high-privilege IBM i administrative account connects to the target system over the network and submits a crafted file deletion request embedding path traversal sequences (e.g., '../../critical/system/file') within a parameter that is used directly in a file system operation. IBM i processes the request without adequately normalizing the path, allowing the operation to escape its intended directory scope and delete an arbitrary file on the system. Repeated exploitation targeting IBM i system libraries or application data directories could render critical business workloads inoperable.