An uncontrolled search path element in IBM i 7.6, 7.5, 7.4 and 7.3 permits a remote authenticated attacker to execute arbitrary code. This flaw arises because the operating system accepts an untrusted path during executable lookup, allowing the attacker to place a malicious program in a directory that is searched before the intended target.

Affected versions are IBM i 7.6, 7.5, 7.4 and 7.3. PTFs to address the issue include SJ10879 for 7.6, SJ10880 for 7.5, SJ10881 for 7.4 and SJ10882 for 7.3.

The CVSS score is 9.9, indicating critical severity, and the vulnerability is not listed in the CISA KEV catalog. The description states that a remote authenticated attacker can exploit it, so the likely attack vector is a remote connection that gains sufficient privilege to install or execute code on the IBM i system. No EPSS score is available, but the high CVSS suggests that, if exploited, the attacker could compromise confidentiality, integrity and availability of the entire system.