CVE-2026-18509

Undergoing Analysis Undergoing Analysis - In Progress

Privilege Escalation in IBM i via Navigator for i Debugger

Publication date: 2026-08-13

Last updated on: 2026-08-17

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-17

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-01

NVD

CVE-2026-18509

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	7.3
ibm	i	7.4
ibm	i	7.5
ibm	i	7.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM i systems allows a local authenticated attacker to escalate privileges through the Navigator for i debugger. The attacker could then access or modify sensitive data or create new profiles with higher privileges on the system.

Detection Guidance

This vulnerability involves privilege escalation via the Navigator for i debugger on IBM i systems. Detection requires checking for unauthorized access or modifications to system profiles and debugger configurations. Review system logs for suspicious activity related to Navigator for i and user profile changes. Examine debugger settings for unauthorized access.

Impact Analysis

An attacker could gain unauthorized access to sensitive data, manipulate system configurations, or create privileged accounts. This could lead to data breaches, system misuse, or further attacks on the IBM i environment.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, which may violate compliance requirements such as GDPR or HIPAA. Organizations may face penalties or legal consequences if such breaches occur due to inadequate security measures.

Mitigation Strategies

Apply the latest IBM i PTFs or updates for Navigator for i debugger to address the privilege escalation flaw. Restrict local authenticated user access to sensitive system functions and monitor for unusual profile creation or data access patterns.

Hi! I’m here to help you understand CVE-2026-18509. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70