The CVSS 8.6 score is telling you something important: this is not an unauthenticated internet-facing RCE. The gap to 9.8+ reflects real exploitability constraints — IBM i's "remote" typically means from an authenticated connection context or application tier, not raw network access. More critically, this is a denial-of-service via out-of-bounds write, not code execution. That's a meaningful downgrade in the abstract, but not on IBM i. Your payroll doesn't halt when a SaaS app goes down. It halts when IBM i does. The blast radius of DoS here is operational — manufacturing stops, orders stall, ERP workflows collapse. That's why the CVSS score doesn't map to impact the way it would on other platforms.
The four-version reach (7.3 through 7.6) is the forensic signal that matters most. This isn't four independent bugs — it's one component, likely in the ODBC, communications, or IBM i Access layer, that simply wasn't modified across that entire span. It survived the integration decade (2014–2022) where REST APIs, ODBC drivers, and Access interfaces proliferated, exposing this code to untrusted input for the first time in years. The discovery lag in legacy systems runs 5–8 years between exposure and vulnerability finding. You've likely entered that window for IBM i's network-facing services.
What to do: verify that ODBC, JDBC, and IBM i Access services are network-segmented to trusted application tiers only — not exposed broadly. Identify which business processes depend on the affected component, because DoS there is business-critical. If you run multiple IBM i versions, note that vulnerability in a shared service affects all of them until all are patched — the exposure compounds across version sprawl. The DoS label may suppress researcher attention, but that also means this is probably the first find in a clustered lineage, not the last.
Patch economics on IBM i are slower, and production windows are tight. But given what's at stake, accelerated regression testing for this one is worth the disruption.