IBM i EUVD-2026-58469

Exploitation requires an existing authenticated session on the IBM i system with at least low-level user privileges (PR:L confirmed by CVSS). The attacker must have access to the Navigator for i web-based management interface and specifically its debugger component - environments that restrict Navigator for i access to administrators only are not exploitable by low-privilege users. Exploitation is local-only (AV:L); remote unauthenticated attackers cannot exploit this directly. No user interaction from a privileged user is required (UI:N). Limiting factors include: the requirement for local system access, the need for a valid IBM i user account, and access to the Navigator for i debugger interface. Environments that have disabled Navigator for i or restricted debugger access via object authority controls are substantially protected.

The CVSS base score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a high-severity local privilege escalation with significant confidentiality and integrity impact but no availability consequence. The local attack vector (AV:L) substantially limits real-world risk compared to network-exploitable flaws of similar severity. EPSS corroborates this: at 0.20% (10th percentile), automated or widespread exploitation is considered very unlikely by the model. SSVC flags exploitation status as none and automatable as no, consistent with the requirement for physical or logical local access. However, SSVC does assess technical impact as total, meaning a successful attacker achieves complete privilege escalation. The combination of low EPSS, no KEV listing, no public exploit, and a local-only vector strongly suggests this is not a priority for most environments unless IBM i systems are accessible to untrusted or low-privilege local users. No conflicting signals are present - all sources align on low exploitation probability with high potential damage if conditions are met.

A low-privileged local user - such as a developer, operator, or compromised service account - with access to the IBM i system authenticates and navigates to the Navigator for i debugger interface. By exploiting the improper authorization flaw (CWE-285), the attacker triggers a privileged debugger operation without possessing the required authority, effectively bypassing the authorization gate. The attacker then reads sensitive system data or creates a new IBM i user profile with elevated privileges, establishing persistent elevated access. No public exploit code for this scenario has been identified at time of analysis.