An improperly sanitized input in the HTTP Server Administration web application of IBM i 7.3‑7.6 allows a remote authenticated attacker to retrieve sensitive data or execute code. The flaw is an Injection‑type vulnerability (CWE‑94) that can compromise the confidentiality, integrity, and availability of the affected systems.

IBM i releases 7.3, 7.4, 7.5 and 7.6 are affected. These versions run the HTTP Server Administration GUI and expose the vulnerability to authenticated users who have access to the admin interface.

The CVSS score of 9.9 indicates critical risk. Exploitation requires a remote authenticated session to the administration interface; no publicly disclosed exploit exists yet, and the EPSS score is unavailable, while the vulnerability is not in the CISA KEV catalog. The attack vector would involve an authenticated user submitting crafted input through the web GUI, potentially allowing arbitrary code execution.