IBM i EUVD-2026-58388

The attacker must hold valid IBM i credentials with at least low-privilege access (PR:L per CVSS vector) - anonymous or unauthenticated attackers cannot exploit this vulnerability directly. Exploitation occurs over the network (AV:N) and requires no user interaction (UI:N) with low attack complexity (AC:L), indicating the session management flaw is exploitable against default IBM i session handling without requiring non-default configuration. Exploitation is limited by the authentication barrier: the attacker must first obtain valid credentials, either through compromise, credential reuse, or insider access. Scope is unchanged (S:U), meaning post-exploitation impact is confined to the IBM i system itself rather than enabling lateral movement to adjacent systems through this vulnerability alone.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N scores 8.1, reflecting a network-exploitable flaw with low attack complexity and no user interaction needed, but requiring low-privilege authentication. The dual high impact on confidentiality and integrity - with no availability impact - is consistent with unauthorized data access and operation execution rather than denial-of-service. No EPSS data was provided in available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified, suggesting opportunistic mass exploitation is not currently occurring. The primary risk is insider threat or credential-compromised scenarios where an attacker with any valid IBM i account leverages session replay to access data or execute operations beyond their authorization. The authentication prerequisite (PR:L) meaningfully constrains the attack surface compared to unauthenticated vectors, but IBM i systems often serve high-value targets (financial data, ERP), raising the business impact of successful exploitation.

An attacker with a valid low-privilege IBM i account authenticates to the system over the network, then intercepts or manipulates session tokens exploiting the CWE-294 flaw to replay or forge a session associated with a higher-privileged context. Using the hijacked session, the attacker reads sensitive business data (e.g., financial records, ERP data) or executes operations beyond their authorized role. No public POC code is currently known, but the low attack complexity (AC:L) suggests the technique does not require sophisticated tooling once the session management weakness is understood.