This vulnerability arises from improper neutralization of user-controlled input, allowing a remote authenticated attacker to execute arbitrary script code in IBM i Navigator for i. The flaw permits code execution that could compromise the confidentiality, integrity, and availability of the affected system. The weakness corresponds to CWE‑79, indicating an input sanitization issue that is leveraged for remote code execution. The impact is that an attacker who can authenticate can run arbitrary scripts, potentially leading to full system compromise.

IBM i versions 7.6, 7.5, 7.4, and 7.3 are affected. The specific releases include 7.6‑SS1 Option 3, 7.5, 7.4, and 7.3, as enumerated in the vendor’s product list. PTF identifiers for each version are provided (7.6SJ10887, 7.5SJ10888, 7.4SJ10890, 7.3SJ10891).

The CVSS score of 8.9 indicates high severity. The EPSS score is not available, implying limited publicly known exploitation data. The vulnerability is not listed in the CISA KEV catalog. As the attack vector is remote and requires authentication, successful exploitation would require valid credentials to log into Navigator for i. Once authenticated, the attacker can load malicious scripts that are executed with the privileges of the authenticated user, potentially escalating privileges or compromising the host.