IBM i EUVD-2026-83299

Exploitation requires (1) the IBM i FTP server being enabled and network-reachable, and (2) the attacker holding valid FTP credentials (PR:L - authenticated), since the flaw is triggered by sending crafted FTP PORT and EPRT commands within an established session. The concrete prerequisite is an FTP account whose PORT/EPRT-supplied address the attacker controls; useful impact further requires internal network services that become reachable through the IBM i host acting as an SSRF pivot (scope change, S:C). Limiting factors: authentication is mandatory, impact is limited to confidentiality/integrity of the reached internal services (C:L/I:L, no availability impact), and value depends on there being sensitive internal services segmented behind the IBM i host that the attacker cannot otherwise reach.

This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4 Medium) is internally consistent with the description: a network-reachable, low-complexity FTP bounce/SSRF (CWE-918) that requires an authenticated FTP session (PR:L) and crosses a security boundary (S:C) to reach internal services the attacker should not touch. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the signals do not conflict, they simply point to a not-yet-widely-weaponized vulnerability. The main risk driver is the scope change: a low-privilege FTP user can pivot the trusted IBM i host into an SSRF relay against otherwise-unreachable internal network services. The main risk limiter is the authentication requirement (PR:L) plus the low, partial C:L/I:L impact and no availability impact. Net: a real defensive priority for shops running IBM i FTP with untrusted or numerous FTP accounts, but not a drop-everything critical given authentication is required and no exploitation is confirmed.

An attacker holding valid but low-privileged FTP credentials on an IBM i host connects and issues crafted PORT/EPRT commands whose IP/port fields point at internal-only services (for example an internal database, admin port, or management interface) rather than the client. Because IBM i does not properly validate these commands, it opens data connections to those internal targets on the attacker's behalf, using the trusted host as an SSRF pivot to reach services blocked from the attacker's own network. No public exploit code is identified in the provided data, though FTP-bounce/PORT-command abuse is a well-understood classical technique.