CVE-2026-18509

Received Received - Intake

Privilege Escalation in IBM i via Navigator for i Debugger

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-18509

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	ibm_i	7.3
ibm	ibm_i	7.4
ibm	ibm_i	7.5
ibm	ibm_i	7.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM i systems allows a local authenticated attacker to escalate privileges through the Navigator for i debugger. The attacker could then access or modify sensitive data or create new profiles with higher privileges on the system.

Impact Analysis

An attacker could gain unauthorized access to sensitive data, manipulate system configurations, or create privileged accounts. This could lead to data breaches, system misuse, or further attacks on the IBM i environment.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, which may violate compliance requirements such as GDPR or HIPAA. Organizations may face penalties or legal consequences if such breaches occur due to inadequate security measures.

Mitigation Strategies

Apply the latest IBM i PTFs or updates for Navigator for i debugger to address the privilege escalation flaw. Restrict local authenticated user access to sensitive system functions and monitor for unusual profile creation or data access patterns.

Hi! I’m here to help you understand CVE-2026-18509. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70