IBM i versions 7.3 through 7.6 contain a CWE-79 cross-site scripting vulnerability caused by improper neutralization of user-controlled input during web page generation. This flaw enables a remote attacker with authentication to execute arbitrary script code in the context of the affected web application, potentially leading to a complete compromise of confidentiality and integrity, and partial impact on availability. The CVSS 3.1 base score is 8.9, reflecting network attack vector, low attack complexity, required privileges, user interaction, and scope change.

Successful exploitation allows a remote authenticated attacker to execute arbitrary script code, which can lead to full compromise of confidentiality and integrity of the system and partial impact on availability. This may enable actions such as session hijacking, unauthorized actions on behalf of users, or other malicious activities within the context of the affected IBM i web interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict access to the affected IBM i web interfaces to trusted users and monitor for suspicious activity. Follow IBM's official advisories for updates on remediation.