IBM i versions 7.3 through 7.6 contain a CWE-426 Untrusted Search Path vulnerability that could enable a remote authenticated attacker to execute arbitrary code. This occurs because the system improperly handles the search path for executable files, allowing an attacker to influence which code is executed. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability with low attack complexity and no user interaction required. No vendor advisory or patch information is currently available.

Successful exploitation allows remote authenticated attackers to execute arbitrary code on affected IBM i systems, potentially leading to full system compromise including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict remote authenticated access and monitor for suspicious activity related to executable path manipulation.