IBM i EUVD-2026-71486

Exploitation requires an active session on the IBM i system with high special authorities (equivalent to *ALLOBJ or *SECADM). AV:L confirms the attack must be performed locally on the target partition - remote network exploitation is not possible. AC:L indicates no race condition or unusual system state is needed once privileges are obtained. The hardcoded constants are static across affected versions (7.3-7.6), so an attacker who obtains those constants through binary analysis can exploit any unpatched system in that range. What limits exploitation: (1) an authenticated high-privilege account is mandatory - PR:H; (2) physical or network logical access to the IBM i partition is required; (3) no UI:N concern, but the attacker must already be operating as a privileged user. Standard IBM i environments with strict profile management and separation of duties materially reduce realistic risk.

The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N = 4.4 Medium) accurately reflects the constrained threat model: exploitation is strictly local and requires high administrative privileges, substantially limiting the attacker pool to insiders or accounts already fully compromised. The confidentiality impact is rated High because recovering encryption keys can transitively expose all data those keys protect, which on IBM i may include regulated or sensitive enterprise records. No EPSS score, KEV listing, or proof-of-concept code is included in the available data, and this is consistent with the high-privilege barrier making opportunistic exploitation unlikely. The primary real-world risk is a privileged insider or a threat actor who has already achieved admin-level persistence on an IBM i partition quietly recovering key material to decrypt stored data without triggering integrity or availability alarms. The absence of an integrity or availability component means this is a stealth disclosure path, not a disruptive attack. Overall priority is low-to-medium for most environments given the privilege prerequisite, but elevated for regulated industries (finance, healthcare) where IBM i is used to store encrypted sensitive records.

A privileged IBM i system administrator or compromised high-privilege service account uses knowledge of the hardcoded obfuscation constants (obtainable through binary analysis of IBM i system software) to write a local utility that reverses the key-obfuscation step, extracting plaintext encryption keys stored in system objects. The recovered keys are then used offline to decrypt sensitive data such as financial records or credentials stored in IBM Db2 for i, with no integrity or availability impact that would alert monitoring systems. No public exploit code has been identified at time of analysis.