CVE-2026-18099

Analyzed Analyzed - Analysis Complete

Cross-Site Scripting in IBM i

Publication date: 2026-08-12

Last updated on: 2026-08-17

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-17

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-18099

EUVD

EUVD-2026-57528

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	7.3
ibm	i	7.4
ibm	i	7.5
ibm	i	7.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in IBM i's Navigator for i component. It allows an authenticated user to inject arbitrary JavaScript code into the Web UI, which can alter intended functionality and potentially lead to credential disclosure within a trusted session.

Detection Guidance

The provided CVE data does not include specific detection methods or commands for identifying this vulnerability on a network or system. IBM recommends applying the appropriate PTF to remediate the issue.

Impact Analysis

An attacker could exploit this to execute malicious scripts in your browser, steal session cookies or credentials, or perform unauthorized actions on your behalf within the IBM i interface.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized script execution that may lead to credential disclosure or data manipulation within a trusted session. The stored XSS flaw allows attackers to inject malicious JavaScript, which could compromise user credentials or sensitive data, violating confidentiality requirements under these regulations.

Mitigation Strategies

Apply the appropriate PTF (Program Temporary Fix) as recommended by IBM for IBM i versions 7.3 through 7.6 to address the stored XSS vulnerability in Navigator for i.

Hi! I’m here to help you understand CVE-2026-18099. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70