Code for IBM i EUVD-2026-97969

Exploitation requires all of the following: (1) the attacker holds a separate local account on the same IBM i system as the victim; (2) a Code-for-IBMi component object (e.g., the GETMBRINFO program) was installed with broad *PUBLIC permissions permitting modification by other local accounts; (3) the extension is a version prior to 3.0.1, which accepts a component after merely confirming a procedure exists and relies on the LONG_COMMENT marker, never verifying component integrity; and (4) a victim subsequently initiates a connection through the extension that invokes the tampered component. Limiting factors that reduce realistic risk: the attacker needs valid local IBM i credentials, the target object must have been deployed with permissive (non-restrictive) authorities, and no impact occurs unless a victim connects and triggers the component after it has been altered.

CVSS 4.0 base score is 8.9 (high), but the real-world risk is more constrained than that headline suggests. Exploitation is not remote-unauthenticated: it requires an attacker to already hold a local account on the target IBM i system (PR:L), the vulnerable component object (e.g., GETMBRINFO) to have been installed with broad *PUBLIC permissions (the CWE-732 root cause), the extension to be a version prior to 3.0.1, and - critically - a separate victim to subsequently connect via the extension and invoke the tampered component (UI:P / AT:P). No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. SSVC decision data was not supplied. Note a signal conflict: the vendor CVSS 4.0 vector asserts AV:N (network), yet the description frames the malicious action as a local account altering a program object on the IBM i - the 'network' element appears to be the victim's later connection rather than the attacker's intrusion vector, so AV:L is arguably more faithful; verify the attack-vector interpretation with the vendor. Net assessment: a legitimately serious integrity/code-execution flaw for multi-user IBM i environments, but gated behind a local foothold, insecure object permissions, and a victim action - a targeted insider/lateral-movement risk rather than a mass-exploitation priority.

A low-privileged user on a shared IBM i system notices that a Code-for-IBMi component program such as GETMBRINFO was installed with broad public write permissions and replaces it with a malicious variant; because pre-3.0.1 only checks that the procedure exists (relying on the LONG_COMMENT marker) rather than verifying integrity, the tampering is not detected. When a developer with higher privileges later connects through the VS Code extension and the component is invoked, the attacker's altered program runs under the connecting developer's account, yielding code execution in that user's context. No public proof-of-concept is known at time of analysis, and success depends on the victim connecting after the object is poisoned.