IBM i EUVD-2026-98178

Exploitation requires (1) network reachability to the IBM i File Server service and (2) valid low-privilege IBM i user credentials (CVSS PR:L) - it is NOT exploitable by fully unauthenticated attackers. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The affected component is specifically the File Server on IBM i 7.3 through 7.6; the triggering vector is a malformed request that causes an out-of-bounds read (CWE-125). The primary limiting factor is the authentication requirement, which confines realistic exploitation to insiders or attackers who have already obtained account credentials; environments that restrict File Server network exposure and enforce strong credential hygiene further reduce exposure.

Multiple signals converge on a MODERATE priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:H, base 8.1) indicates a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) - so an attacker must already possess valid credentials on the IBM i system, which meaningfully limits the exploit population to insiders or holders of compromised accounts. The EPSS score is low (0.41%, 33rd percentile), and CISA's SSVC decision framework reinforces this: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified. These signals are mutually consistent - a high CVSS driven largely by the dual C:H/A:H impact, but with real-world exploitation gated behind authentication and no evidence of active or automated attack. The one tension worth noting: the description characterizes the outcome as 'denial of service and obtain information,' which aligns with A:H and C:H, but an out-of-bounds read (CWE-125) typically leaks limited adjacent memory rather than full system data, so C:H may be conservative-leaning-high; the information disclosure may be partial in practice, consistent with SSVC Technical Impact=partial. Verdict: a genuine patch-worthy issue for IBM i shops, but not a drop-everything item given authenticated access requirement, low EPSS, and absence of KEV/POC.

A remote attacker holding valid but low-privileged IBM i credentials (or who has compromised such an account) connects to the File Server service over the network and sends a crafted request that triggers an out-of-bounds read in the server's parsing logic. The resulting over-read either crashes or hangs the File Server (denial of service) or returns adjacent process memory to the attacker (information disclosure). No public exploit code has been identified at time of analysis, and exploitation is not automatable per CISA SSVC.