IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability classified as CWE-269 (Improper Privilege Management). This flaw arises from improper validation of pointers read from Java-controlled addresses, which could be exploited by a remote authenticated attacker to escalate privileges. The CVSS 3.1 base score is 8.4, indicating a high impact on confidentiality, integrity, and availability. The attack vector requires network access with low privileges and no user interaction, but the complexity is high. No official patch or remediation level has been published yet.

Successful exploitation could allow an authenticated remote attacker to gain elevated privileges on the affected IBM i systems, potentially compromising confidentiality, integrity, and availability of the system. The vulnerability affects multiple IBM i versions, increasing the risk surface for organizations using these versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should restrict remote authenticated access to IBM i systems and monitor for suspicious activity related to privilege escalation attempts.