A local attacker with sufficient privileges on an IBM i system running versions 7.3 through 7.6 can trigger a denial of service due to improper access control. The flaw allows the attacker to disrupt normal operation, potentially bringing down services or the entire system, but does not directly expose confidential data. The weakness is classified as CWE‑200, indicating an information exposure style of vulnerability that manifests as service interruption.

IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected. PTFs that address the issue include MJ11636 and MJ11441 for 7.6, MJ11635 and MJ11439 for 7.5, MJ11634 and MJ11438 for 7.4, and MJ11633 and MJ11448 for 7.3. Upgrade to the latest supported IBM i release that incorporates these fixes whenever possible.

The CVSS score of 5.3 indicates moderate severity. The exploit is limited to users who already have local access to the IBM i system, and no publicly available remote exploitation paths are documented. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting low likelihood of widespread exploitation. Nonetheless, the local denial of service can have significant operational impact in environments where uptime is critical.