The vulnerability in IBM i versions 7.3 through 7.6 allows a remote attacker to trigger distinct error codes during the sign‑on process, revealing the existence of user profiles. This constitutes an information‑disclosure flaw (CWE‑200) that does not provide privilege escalation or remote code execution but can expose sensitive account data to the attacker.

Affected releases are IBM i 7.3, 7.4, 7.5, and 7.6, all of which are vulnerable until an IBM i Release 5770‑999 or the corresponding IBM i Product Fix Kits are applied. Earlier unsupported releases remain at risk until upgraded or patched.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so exploitation likelihood is not quantified, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote network access to the sign‑on service, where an attacker can initiate sign‑on attempts that produce distinct error codes without any local privileges.