The vulnerability involves missing subtree checks during file handle resolution in IBM i NFS services, allowing a local attacker to obtain sensitive information. This failure of proper authorization is classified as CWE-284, leading to information disclosure and potential privilege escalation within the local environment. The primary consequence is that confidential data accessible through the NFS service can be accessed by an attacker who can run code on the host or connect to the NFS server locally.

IBM i systems running releases 7.3, 7.4, 7.5, or 7.6 are affected, and the fixes are distributed as PTFs: SJ11753 for release 7.6, SJ11790 for 7.5, SJ11802 for 7.4, and SJ11804 for 7.3. Users of unsupported versions are advised to upgrade to a supported, fixed version of IBM i.

The CVSS score of 5.4 places this vulnerability in the moderate severity range, and the EPSS score is not available, indicating there is no publicly known exploitation data. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is local; an attacker must have the ability to execute code or have access to the IBM i host. If the pre-install actions required by IBM are not performed, existing NFS mounts may become inaccessible, compounding the risk with potential outage. Because the weakness is an authorization flaw, the overall risk is moderate unless the attacker already has local access.