IBM i EUVD-2026-71477

Requires a valid IBM i user credential with at least low-privilege access (PR:L per CVSS vector). No special non-default configuration or elevated role is needed beyond an active authenticated session and network reachability to the affected IBM i system running versions 7.3-7.6. No user interaction is required on the victim side. Exploitation is limited to availability impact only - no data exfiltration or system modification is possible. Organizations where low-privilege or contractor accounts have direct network access to IBM i services face the highest practical risk.

The CVSS 6.5 medium rating accurately reflects the constrained impact profile: exploitation requires at least a low-privilege authenticated session (PR:L), so unauthenticated remote attackers cannot trigger this directly. The attack vector is network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), meaning any authenticated user - including those with minimal permissions - can reliably cause an availability outage. Impact is purely availability (A:H) with no confidentiality or integrity consequence (C:N/I:N), limiting the risk to service disruption. No CISA KEV listing, no POC, and no EPSS score are present in the available data, all pointing to no observed active exploitation. For IBM i environments, the real-world risk is most meaningful where untrusted or low-privilege users have network access to IBM i services - a common scenario in multi-tenant or contractor-access deployments. The authentication barrier reduces urgency compared to a PR:N vulnerability, but given IBM i's role in critical business operations, even temporary availability loss can have significant business impact.

An attacker with any valid IBM i account - such as a contractor, internal user, or compromised service account - sends a specially crafted network request to the vulnerable IBM i component. The request triggers a NULL pointer dereference in the server-side handler, causing the affected process or subsystem to crash and rendering IBM i services unavailable to all users until the system is restarted or the subsystem is recycled. No public exploit code is known to exist, but the low attack complexity (AC:L) suggests the trigger condition is reliably reproducible once identified.