The vulnerability identified in IBM i 7.6, 7.5, 7.4, and 7.3 allows a remote unauthenticated attacker to harvest user credentials by exploiting a spoofing flaw in the Navigator for i component. By forging authentication requests, an attacker can obtain credentials that may be used for further lateral movement or privilege escalation. The weakness is classified as CWE-346, indicating improper authentication or impersonation controls.

IBM i platform versions 7.6, 7.5, 7.4, and 7.3 are affected, as identified by the IBM i platform CNA. No sub-release detail is provided beyond the major release numbers and the corresponding PTF identifiers SJ10887, SJ10888, SJ10890, and SJ10891.

The CVSS score of 8.8 marks this flaw as high severity, and the EPSS score is not available; however, the lack of authentication requirements indicates a straightforward attack path for an adversary. The vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently widely exploited, but the high CVSS and the potential for credential harvesting make it a priority for immediate remediation.