CVE-2026-18221

Received Received - Intake

Unauthorized Access in IBM i Due to Authentication Bypass

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-04

Generated

2026-09-05

AI Q&A

2026-09-05

EPSS Evaluated

N/A

NVD

CVE-2026-18221

EUVD

EUVD-2026-71607

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	7.6
ibm	i	7.5
ibm	i	7.4
ibm	i	7.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM i versions 7.6, 7.5, 7.4, and 7.3 allows a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the system, potentially leading to data breaches, unauthorized data manipulation, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and data exposure, which may violate compliance requirements such as GDPR (data protection) and HIPAA (health information security), potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Apply IBM i PTFs or updates addressing improper authentication validation. Review and restrict remote access to IBM i systems. Monitor for unauthorized access attempts or unusual authentication patterns.

Hi! I’m here to help you understand CVE-2026-18221. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70