Technical impact
IBM i releases 7.3 through 7.6 expose an authentication flaw that permits a remote attacker to repeatedly submit login attempts, potentially discovering valid credentials. The vulnerability is classified as CWE‑307. The impact is that an attacker could gain unauthorized access to the system if successful, but the description does not explicitly state broader confidentiality or integrity effects.
Affected Systems
The affected systems are IBM i version 7.3, 7.4, 7.5, and 7.6. IBM recommends users run supported versions, such as Release 5770‑999, or apply the applicable patch (PTF) for each release – for instance MJ11636 or MJ11441 for 7.6, MJ11635 or MJ11439 for 7.5, MJ11634 or MJ11438 for 7.4, and MJ11633 or MJ11448 for 7.3.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, indicating limited evidence of public exploitation. The likely attack vector is remote login attempts over the network; an attacker would need to perform repeated authentication attempts, which can be mitigated by enforcing account lockout or rate‑limiting controls.
