The EPSS-CVSS gap on CVE-2026-17485 (8.2 CVSS, 0.0029 EPSS) is a signal you should not ignore. The low exploitation probability score reflects the narrow conditions required to reach this flaw, not the severity of what happens if an attacker gets there. On IBM i, that gap may be a false comfort.
This is an integer underflow in a parsing or protocol handling context — the kind of flaw that doesn't just crash the system (denial of service) but permits controlled read access beyond intended boundaries. That dual capability is the detail that should worry you. On a platform running payroll, financial records, ERP, and supply chain systems, adjacent memory in a parsing context doesn't contain trivial data. It may contain database access credentials, active job structures, user profile information, or transaction state still in process. This isn't a crash-in-a-utility scenario; it's a potential memory exposure in a system of record.
The four-version scope (7.3 through 7.6) tells you something important about how this flaw persisted. Either it was recently introduced in shared code, or it's a long-standing issue that went undetected — inherited code carried forward across releases without auditing, the kind of core platform component that gets assumed to be stable. The pattern of integer underflow in parsing layers has documented precedent in RPC and network service contexts across platforms. The institutional failure isn't that one bad commit slipped through; it's that the development culture around IBM i treats stability as paramount and defers security auditing as disruptive, producing exactly this pattern of flaws surviving behind the assumption that core components 'don't change.'
Your action items: First, determine whether the affected parsing component (likely in DDS or a related network service) is network-adjacent in your environment. If it's exposed — even behind internal networks — treat this as a priority patch. Second, question whether your organization has been applying IBM i patches with the same rigor as Windows or Linux. The platform's reputation for obscurity has created a self-reinforcing cycle where researchers don't invest in finding IBM i flaws, EPSS scores stay low, and organizations deprioritize patching — but the consequence severity when exploitation succeeds remains catastrophic. Third, check your version inventory: the CVE stops at 7.3, but the code path almost certainly continues in earlier versions. If you're running 7.2 or earlier, those systems are not just out of support — they're running the same flawed code with no prospect of a fix.