On IBM i 7.3 through 7.6, CVE-2026-17029 is an out-of-bounds write that allows privilege escalation from any local user to higher authority. The CVSS score of 8.8 is technically accurate — but on this platform, the label 'local attacker' describes a threat category that includes vendor support accounts, contractor access for ERP customizations, third-party middleware running under IBM-supplied profiles, and managed service provider tunnels. These aren't outsiders who just arrived; they're authenticated users already inside the trust boundary by design. The vulnerability converts that limited-but-authorized access into unrestricted execution.
The EPSS score of 0.00122 predicts probability of automated exploitation, and for mass-campaign exploitation that metric is probably right. But the adversaries who actually target IBM i — sophisticated state actors and organized crime running sustained operations — don't generate the telemetry EPSS models learn from. They already have initial access through credential theft or phishing, and they use local privilege escalations as precision tools, not lottery tickets.
The practical danger isn't that this CVE will be scanned for and exploited at scale. It's that for organizations with IBM i deployments, the exploitation path runs through integrations that most security teams can't see: the ERP system, the database of record, the manufacturing control layer that downstream supply chain systems trust. A successful privilege escalation on IBM i is a lateral movement into business-critical infrastructure, not just 'attacker got more code execution.'
The more immediate problem is remediation lag. IBM i patching follows quarterly change windows tied to business cycles — not the days-to-weeks cadence commodity platforms assume. A disclosed privilege escalation that remains unpatched for 90 days on a system where initial access is already likely through other vectors isn't a 0.00122 risk; it's a 90-day exposure window during which any actor with a foothold has a reliable escalation tool. EPSS measures instantaneous exploitation probability, not accumulated systemic exposure.
What you can do: treat every local vulnerability on IBM i as a post-compromise escalation path by default, not as an initial access vector. Map what your IBM i system integrates with and what those downstream systems trust. Review who holds vendor, contractor, and service accounts with interactive access — those are your pre-compromise threat surface. If your SIEM can't instrument CL commands, IBM i Navigator sessions, or 5250 emulator traffic, acknowledge that visibility gap explicitly rather than assuming absence of exploitation means absence of targeting.