CVE-2026-18071

Analyzed Analyzed - Analysis Complete

Improper Privilege Management in IBM i

Publication date: 2026-08-13

Last updated on: 2026-08-17

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-17

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-01

NVD

CVE-2026-18071

EUVD

EUVD-2026-58227

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	7.3
ibm	i	7.4
ibm	i	7.5
ibm	i	7.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-18071 is an improper privilege management vulnerability in IBM i's HTTP Server component. It allows a local attacker to escalate privileges due to flawed access controls. Affected versions include IBM i 7.3, 7.4, 7.5, and 7.6.

Detection Guidance

To detect this vulnerability, check if your IBM i system is running an affected version (7.3, 7.4, 7.5, or 7.6) with the 5770-DG1 license program. Verify if the required PTF fixes (SJ11138 for 7.3, SJ11137 for 7.4, SJ11136 for 7.5, SJ11135 for 7.6) are applied. Use the command DSPPTF LICPGM(5770DG1) to list installed PTFs and confirm the fixes are present.

Impact Analysis

This vulnerability could let a local attacker gain elevated privileges, potentially leading to unauthorized access, data manipulation, or system disruption. It impacts confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability could lead to unauthorized privilege escalation, potentially compromising confidentiality and integrity of sensitive data. This may impact compliance with GDPR (data protection) and HIPAA (healthcare data security) by increasing risks of unauthorized access or data breaches.

Mitigation Strategies

Apply the provided PTF fixes for your IBM i version: SJ11138 for 7.3, SJ11137 for 7.4, SJ11136 for 7.5, or SJ11135 for 7.6.
If running an unsupported IBM i version, upgrade to a supported release immediately.

Hi! I’m here to help you understand CVE-2026-18071. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70