The vulnerability stems from improper validation of transaction identifiers supplied by an attacker, allowing a remote actor to manipulate distributed transactions without authorization. This flaw, identified as CWE‑285, permits changes to transaction flow and integrity, potentially corrupting data consistency and violating transactional guarantees.

IBM’s i operating system, versions 7.3, 7.4, 7.5, and 7.6, is affected. The fix is distributed as PTFs SJ11429 and SJ11543 for 7.6, SJ11430 and SJ11545 for 7.5, SJ11431 and SJ11546 for 7.4, and SJ11435 for 7.3. Users on unsupported versions should upgrade to a supported, fixed release.

The CVSS score of 3.7 indicates a moderate risk level, while the EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; an attacker would need to send crafted transaction identifiers to the affected IBM i system to exercise the flaw. Given the moderate severity and lack of publicly known exploits, the overall likelihood of exploitation remains uncertain but should not be dismissed.