CVE-2026-18715

The 'authenticated attacker' requirement in this CVE creates a misleading severity picture. On most platforms, an authenticated attacker inside the trust boundary means the game's largely over. On IBM i, the authentication layer is a gateway, not a containment boundary. Once authenticated, a user can reach DB2 for i through ODBC/DRDA, navigate the IFS with object-level permissions, and invoke CL commands that touch system state most security tools don't instrument. This XXE doesn't necessarily escalate privileges — it provides a lateral pivot into configuration streams and system state that exists outside the IFS permission hierarchy entirely: QSYSPITF objects, system values, job attributes. An authenticated user can query many of these through normal interfaces, but the XXE vector aggregates them into a single request that leaves no conventional audit trail. The version spread (7.3 through 7.6) matters because IBM i release cycles span years, not months. Organizations often run 2-3 releases behind current, meaning this flaw may have existed undetected for half a decade across systems handling ERP, financial, and healthcare workloads. The real detection problem: XML processing in IBM i middleware often runs under service account contexts that generate logs nobody monitors. Even if someone remembered this code existed, they'd struggle to identify XXE exploitation because the logs show normal-looking XML processing under a trusted context. Your priority: inventory all XML-processing endpoints in your IBM i middleware stack — Web Services, IBM HTTP Server, RPG integration points — and verify whether DTD processing is enabled. Even if authenticated users 'already have access' to your IFS, the XXE vector can reach configuration state your native authorization model never intended to gate. The EPSS 0.00249 likely reflects analyst unfamiliarity with IBM i rather than genuine exploitation difficulty — treat this as exploitable until proven otherwise.

Reviewed through automated stages and approved by a human before publication.