IBM i EUVD-2026-58453

Network access to IBM i 7.3, 7.4, 7.5, or 7.6 is required. Per the PR:N CVSS metric, no authentication is needed; per UI:N, no user interaction is required. The specific IBM i service or network interface accepting the malformed tokens is not named in available data, limiting precise identification of the attack surface. Exploitation is partially constrained by IBM i systems being typically deployed inside enterprise network perimeters with limited external exposure, and by SSVC's 'Automatable: no' determination - which implies a non-trivial element (possibly knowledge of token structure, protocol detail, or specific service endpoint) must be satisfied to reliably exploit at scale. No non-default configuration, specific feature flag, or special deployment mode is identified as a prerequisite in available data.

The CVSS base score of 8.2 (High) is driven by network reachability (AV:N), low attack complexity (AC:L), no required privileges (PR:N), no user interaction (UI:N), high confidentiality impact (C:H), and low integrity impact (I:L). However, multiple secondary signals temper real-world priority: EPSS at 0.31% (23rd percentile) reflects very low current exploitation probability relative to the broader CVE population. More notably, the SSVC framework rates this vulnerability as 'Automatable: no' - a finding that directly conflicts with the AC:L/PR:N CVSS metrics, which would ordinarily imply high automation potential. This discrepancy suggests an unstated prerequisite (such as knowledge of a specific token format, a particular exposed service, or protocol internals) that limits mass or scripted exploitation despite low nominal complexity. SSVC also rates Technical Impact as 'partial', consistent with C:H/I:L/A:N (no availability impact). No KEV listing and no publicly available proof-of-concept code further support lower operational urgency than the raw score implies. IBM i environments are typically hardened enterprise systems behind network perimeters, but authentication bypass on a platform managing sensitive business data warrants prompt remediation.

A remote unauthenticated attacker with network access to an exposed IBM i system identifies an authentication endpoint, crafts a token that exploits the improper validation logic, and submits it to bypass access controls without presenting valid credentials. The attacker obtains high-confidentiality system data and can perform limited unauthorized write or modification operations. No public proof-of-concept code has been identified at time of analysis, and SSVC's 'Automatable: no' finding suggests reliable exploitation may require non-trivial knowledge of the token format or service internals.