The vulnerability arises from improper neutralization of user-supplied input in the IBM i HTTP Server Administration GUI, allowing a remote authenticated attacker to execute arbitrary script code. This flaw maps to CWE-79 and can lead to full compromise of the affected system, exposing confidential data, modifying system state, and potentially allowing lateral movement. The impact is limited to systems where the attacker can authenticate to the administration interface.

IBM i 7.3, 7.4, 7.5, and 7.6 are affected. Users of these releases should apply the corresponding PTFs: 7.6SJ11645 for 7.6, 7.5SJ11644 for 7.5, 7.4SJ11643 for 7.4, and 7.3SJ11641 for 7.3. Unsupported or older releases should be upgraded to a supported, fixed version of IBM i.

The CVSS score of 8.3 indicates a high severity flaw. EPSS is not available, so a precise exploitation probability is unknown, but the vulnerability requires only authenticated access to the HTTP Server Administration GUI, which likely reduces the barrier to attack. The issue is not listed in CISA KEV, suggesting no widespread active exploit data. The likely attack vector is remote authenticated access through the administration web interface, where an attacker can leverage the input validation flaw to inject and execute malicious scripts.