IBM i EUVD-2026-58468

The attacker must hold valid authentication to the IBM i system (CVSS PR:L) and must be able to execute or influence Java code on that system, since the flaw is triggered through pointers read from Java-controlled addresses - the ability to supply or steer those addresses via a Java workload is the concrete prerequisite. No user interaction is required (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L). The primary limiting factors are the need for a valid account and the need for Java execution capability on the host; systems that tightly restrict Java workloads and low-privilege interactive/network access to the machine reduce the realistic attack surface. This affects IBM i 7.3, 7.4, 7.5, and 7.6.

The signals are mixed and worth weighing carefully. CVSS 3.1 is 9.9 critical driven by network vector, low complexity, only low privileges, no user interaction, and a scope change (S:C) with high confidentiality/integrity and low availability impact. However, EPSS is only 0.27% (18th percentile), CISA SSVC lists Exploitation: none and Automatable: no, and there is no KEV listing and no known public POC - so real-world exploitation pressure is currently low even though the technical impact is rated total. The high score is legitimate given that any authenticated user could, in principle, escalate to elevated privileges, but the 'Automatable: no' and low EPSS suggest exploitation would be non-trivial and not yet mass-scanned. This is a genuine priority to patch on internet-reachable or multi-user IBM i systems, but there is no evidence it is being weaponized today. The requirement for valid authentication (PR:L) is the main real-world limiter - the exposure is largely to insiders or attackers who already hold credentials.

An attacker who holds a valid but low-privileged IBM i account (for example a business application user or a compromised service credential) connects over the network and runs Java code that feeds crafted addresses into the vulnerable pointer-handling path. Because the returned pointers are not properly validated, the attacker escalates to elevated system privileges, breaching the process boundary (S:C) to read and modify data beyond their authority. No public exploit is identified at time of analysis, and the CVSS low attack complexity implies reliable exploitation once a working technique exists.