CVE-2026-17075 affects IBM i versions 7.3 through 7.6, exposing improper authentication token validation across all four major releases. The breadth of this span is the analytically significant detail: a single coding error would typically be caught before shipping or fixed in the next release. That this flaw survived four versions indicates a systemic failure — likely stemming from IBM i's architectural challenge of bridging legacy 5250 session concepts with modern stateless token authentication. The platform's layered authentication interfaces may make correct token validation genuinely difficult to implement, causing developers across multiple components to converge on plausible-but-flawed implementations.
The CVSS 6.5 scoring is instructive. A remote attacker with improper token validation should score higher if exploitation is straightforward. The medium severity suggests the failure mode is probably scope or binding validation — the token is technically valid and not expired, but it's being accepted for resources or operations it shouldn't authorize. This is harder to catch in testing because you need both positive and negative test cases across the full API surface. Parsing failures or expiration bypasses would likely score higher; this constrained scope behavior explains the moderate CVSS.
What to check: examine your IBM i integrations to determine whether your token validation logic verifies not just token validity and expiration, but also scope binding — whether the token is actually authorized for the specific resource or operation being requested. If your applications use IBM i's authentication APIs without explicit scope validation, they may be vulnerable even with the IBM patch applied.
The blast radius is amplified by IBM i's role in enterprise computing. Unlike a token validation failure in a web app, this exposes the operational core — ERP systems, financial ledgers, supply chain logic that downstream subsystems treat as a trust signal. A medium-severity vulnerability with constrained exploitation that gives an attacker access to financial transaction processing is higher priority than the score suggests.
Remediation priority: apply IBM's patch immediately, but recognize that the patch may only fix the specific instance found. The four-version survival indicates the correct canonical pattern for token validation was never clearly established in IBM i's developer documentation. After patching, audit your custom applications for the same flawed pattern — the vulnerable implementation likely propagated into customer codebases across the ecosystem. IBM i shops historically patch slowly due to stability culture, but this one warrants priority given the blast radius into core business logic and the likely scope validation gap.