CVE-2026-17484: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

IBM i versions 7.3 through 7.6 contain a vulnerability identified as CVE-2026-17484, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The issue arises from improper access control mechanisms that could permit a local attacker to access sensitive information without authorization. The CVSS 3.1 base score is 5.3, indicating medium severity, with an attack vector of network, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. There is no indication of integrity or availability impact. No vendor advisory or patch information is provided in the source data.

The vulnerability allows unauthorized local actors to gain access to sensitive information on affected IBM i systems. This exposure could lead to information disclosure but does not affect system integrity or availability. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for unusual access patterns related to sensitive information. Do not assume the vulnerability is mitigated without vendor confirmation.