CVE-2026-18069

Received Received - Intake

IBM i Race Condition Leads to File Ownership Escalation

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) race condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-18069

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	ibm_i	7.6
ibm	ibm_i	7.5
ibm	ibm_i	7.4
ibm	ibm_i	7.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a time-of-check to time-of-use (TOCTOU) race condition in IBM i versions 7.6, 7.5, 7.4, and 7.3. A local attacker could exploit this to gain ownership of arbitrary file system objects.

Impact Analysis

A local attacker could exploit this to modify or take control of critical system files, potentially leading to unauthorized access, data manipulation, or system disruption.

Compliance Impact

This vulnerability could compromise data integrity and access controls, potentially violating compliance requirements for GDPR, HIPAA, and other standards that mandate strict file access controls and auditability.

Mitigation Strategies

Apply IBM i PTFs or updates provided by IBM to address the TOCTOU race condition. Monitor IBM i security advisories for patches and implement strict file system access controls to limit user permissions.

Hi! I’m here to help you understand CVE-2026-18069. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70