CVE-2026-18715

Received Received - Intake

XML External Entity Processing in IBM i

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-18715

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	ibm_i	From 7.6 (inc)
ibm	ibm_i	From 7.5 (inc)
ibm	ibm_i	From 7.4 (inc)
ibm	ibm_i	From 7.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM i versions 7.6, 7.5, 7.4, and 7.3 allows a remote authenticated attacker to access sensitive information. It occurs due to improper handling of XML external entities, which can lead to information disclosure.

Impact Analysis

An attacker could exploit this to steal confidential data, such as user credentials or system configurations. This may lead to further attacks or unauthorized access to sensitive resources.

Compliance Impact

This vulnerability could result in unauthorized data exposure, violating GDPR and HIPAA requirements for protecting personal and health information. Non-compliance may lead to legal penalties and reputational damage.

Mitigation Strategies

Apply IBM i PTFs or updates to address improper XML external entity processing. Disable unnecessary XML external entity processing in applications handling XML data. Restrict remote authenticated access to trusted users only.

Hi! I’m here to help you understand CVE-2026-18715. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70