IBM i EUVD-2026-58394

Exploitation requires network-level reachability to the IBM i system's DRDA or DDM service ports. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and attack complexity is low, meaning no special protocol knowledge or privileged session is needed beyond basic network access. The vulnerability is specific to resynchronization message handling within DRDA and DDM, so the primary limiting factor is network segmentation: systems with DRDA/DDM ports firewalled from untrusted networks have substantially reduced exposure. All four current IBM i major releases (7.3-7.6) are affected, so version alone does not serve as a mitigating factor. There is no indication of a non-default configuration requirement - standard IBM i deployments with DRDA/DDM services active are vulnerable.

The CVSS 3.1 base score of 5.3 (Medium) reflects network reachability with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N), but impact is constrained to partial availability loss (A:L) with no confidentiality or integrity components. EPSS data was not provided in the available intelligence, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. Despite the medium score, the unauthenticated network-reachable nature of the flaw combined with IBM i's role as a critical database and ERP backbone in enterprise environments warrants prioritized attention - even a mid-sized municipal IT team in koszalin running IBM i for financial or logistics workloads should treat this as an urgent patching cycle item rather than a routine medium. The absence of public exploit code moderates immediate urgency, and the limited availability impact (A:L rather than A:H) suggests partial degradation rather than guaranteed complete outage. Primary operational risk is disruption to IBM i DRDA-dependent database services, which in many organizations underpin line-of-business applications.

An unauthenticated remote attacker with network access to IBM i DRDA or DDM service ports sends a crafted sequence of malformed resynchronization requests. The server allocates resources in response to each request without enforcing any consumption ceiling (CWE-770), causing progressive exhaustion of available memory or processing capacity. IBM i database connectivity and dependent business applications degrade or become unavailable until resources are reclaimed or the server is cycled. No public exploit code has been identified at time of analysis.