IBM i CVE-2026-18068

The CVSS vector (PR:L) confirms that exploitation requires a valid low-privileged account on the target IBM i system - unauthenticated remote exploitation is not possible. Network reachability to the IBM i system is required (AV:N), and no user interaction or administrator involvement is needed once the attacker has authenticated (UI:N, AC:L). The primary limiting factor is the authentication prerequisite: an attacker must first possess or obtain valid IBM i credentials, restricting the realistic threat actor pool to insiders, compromised-credential holders, or attackers who have already achieved initial access by other means. No specific feature flag, non-default configuration, or particular protocol mode is identified in the available data as a necessary condition beyond having an active authenticated session.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a medium-severity information disclosure issue: network-accessible and low-complexity to exploit, but requiring a valid low-privileged account and producing only limited confidentiality impact with no integrity or availability consequences. No EPSS score was provided, so exploitation probability cannot be quantified numerically. The vulnerability is absent from the CISA KEV catalog and no public proof-of-concept has been identified, both of which meaningfully reduce real-world urgency beyond the raw CVSS. In practical terms, even a mid-sized municipal IT team in opole running IBM i for ERP or financial systems should treat this as a standard scheduled-patching priority rather than an emergency response - the authentication prerequisite narrows the realistic attacker pool to insiders or those who have already compromised credentials. The limited C:L impact further constrains blast radius, though in regulated industries where confidentiality requirements are strict, any unauthorized data disclosure carries compliance implications disproportionate to the technical severity score.

A low-privileged attacker with valid credentials and network access to an IBM i system sends a crafted request designed to trigger the byte-count and element-count confusion in a vulnerable IBM i component. The confused count causes the system to return a data range larger than authorized, and the attacker reads the over-allocated response to extract sensitive information. No public proof-of-concept has been identified at the time of analysis, making opportunistic exploitation less probable than targeted insider abuse.