CVE-2026-17101

The 8.3 CVSS on this IBM i authentication bypass warrants immediate skepticism. When a vulnerability grants both remote code execution and information disclosure through an authentication flaw, the math doesn't work out to high-8 — something is constraining the score, and understanding what tells you whether to prioritize differently than the vector suggests. The likely explanation: IBM i's security model inverts traditional server assumptions. Unlike Linux or Windows where services run with minimal privilege, IBM i business services routinely execute under elevated user profiles with extensive object authority. DB2, ERP integrations, and financial applications operate with system-level privileges because IBM i was designed for trusted operator environments, not process isolation. This means the authentication bypass doesn't just get you in — it gets you in as a profile that already has access to the data and operations that matter. The CVSS 8.3 may actually be optimistic for IBM i deployments, not a ceiling. The four-version span (7.3 through 7.6) is the stronger signal. This isn't a regression introduced in a recent change — it's either a dormant flaw finally weaponized or a structural weakness in how IBM i propagates authentication state across service interfaces. Either scenario suggests the authentication architecture has systemic gaps that produced this flaw and may produce others. Press your IBM i team on which specific interface — DB2 JDBC/ODBC, HTTP Server, IBM i Services — this affects and under what profile context code execution occurs. The EPSS score of 0.00406 reflects internet-scanning visibility, not actual exploitability. IBM i systems typically sit behind corporate firewalls, connected to ERP, banking interfaces, and partner integrations. The exposure isn't the IBM i server itself — it's everything that trusts an authenticated session originating from it. Treat this as a lateral movement and supply chain risk, not an internet-exposure risk. Priority action: identify which IBM i services bind to this authentication path, determine the privilege context of the running profiles, and validate whether object-level authority would contain or amplify the impact. If those profiles have broad DB2 access, the real-world impact substantially exceeds what CVSS captures.

Reviewed through automated stages and approved by a human before publication.