IBM i versions 7.3 through 7.6 contain a CWE-426 untrusted search path vulnerability that could be exploited by a remote attacker with authentication to execute arbitrary code. This occurs because the system may search for executables or libraries in untrusted directories, allowing malicious code to be run. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting low attack complexity, required privileges, and no user interaction, with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could lead to arbitrary code execution by a remote authenticated attacker, potentially compromising system confidentiality, integrity, and availability. This could allow attackers to take control of the affected IBM i system or disrupt its operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should restrict remote authenticated access to IBM i systems and monitor for suspicious activity related to executable search paths.