The CVSS 8.8 rating for CVE-2026-13105 obscures a threat model that doesn't fit typical vulnerability patterns. This is a zip slip vulnerability in IBM i Access Client Solutions' configuration import feature — malicious archive entries with '../' sequences escape the intended extraction directory. But exploitation requires active delivery of a crafted configuration file to someone who will import it through ACS. That's a fundamentally different attack topology than finding an exposed service and sending payloads.
The EPSS score reflects this distinction. Mass exploitation data doesn't capture targeted configuration-tampering in enterprise back-office environments. The low EPSS likely indicates this is a surgical risk targeting specific operational workflows — the exact environments where automated scanning can't discover the delivery context because it requires knowing how target organizations actually share configuration files.
In IBM i ecosystems, configuration file exchange isn't exceptional or suspicious — it's standard operations. Vendors request configuration exports for troubleshooting. IBM support bundles contain exported settings. Third-party integrations involve configuration sharing across organizational boundaries through consultants and managed service providers. The assumption that an attacker needs to trick someone into importing a malicious file misses that this exchange happens routinely between parties who already have operational trust.
The vulnerability exists because the import code treats archive entry names as trusted input. This isn't novel — zip slip was documented and widely fixed in most frameworks by 2018. Its persistence in IBM i ACS indicates the development ecosystem for this platform simply didn't receive that knowledge transfer. The code path outlived its connection to the security knowledge base that would have protected it.
For defenders, the priority isn't the traversal itself — it's mapping ACS deployments to identify which files can be overwritten to enable further exploitation. Startup scripts, configuration files loaded at boot, scheduled tasks, or any writable files in the ACS execution context represent the real blast radius. The question is which files on an ACS workstation would matter for lateral movement, not whether the traversal works.