IBM i EUVD-2026-98179

Exploitation requires an interactive or authenticated local presence on the affected IBM i host (AV:L) with at least low-level user privileges (PR:L) - it cannot be performed by a remote or fully unauthenticated attacker. The specific prerequisite is the ability to reach the BOOTP table/configuration function on IBM i 7.3, 7.4, 7.5, or 7.6, where the improper authorization check (CWE-269) fails to prevent a user who lacks the proper authority from modifying BOOTP entries. Limiting factors that reduce real-world risk: the attacker must already hold a valid local account, the impact is confined to Low confidentiality and Low integrity with no availability effect, and systems with few or tightly controlled local user accounts have a correspondingly small exposure surface.

This is a genuinely low-to-moderate priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.4 Medium) requires local access and existing low-level privileges on the IBM i host, limiting the attacker pool to users who already have a valid account on the system. The weakness (CWE-269, improper authorization) lets such a user modify the BOOTP table that they should not be authorized to change, yielding only Low confidentiality and Low integrity impact and no availability impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input; per the precision rules this means there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent - a low-complexity but privilege- and local-access-gated authorization flaw - so there is no CVSS-versus-reality conflict to flag; the main caveat is simply that exploitation-probability (EPSS) and exploitation-status (KEV/POC) telemetry are absent, so risk is assessed from the CVSS vector and description alone. Real priority is modest: patch in normal maintenance cycles unless the host has many low-privilege or untrusted local accounts.

A low-privileged but authenticated local user on an IBM i 7.3-7.6 system abuses the improper authorization check to alter entries in the BOOTP table, which they are not supposed to be able to modify. By changing boot parameters they could redirect or tamper with network boot/provisioning of client devices served by that BOOTP configuration. No public exploit code was identified at time of analysis.