What is the CVSS score of CVE-2026-18068?

CVE-2026-18068 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-18068?

Yes, a patch is available for CVE-2026-18068. Update the affected software to the latest version immediately.

IBM i CVE-2026-18068

EUVD-2026-58463 MEDIUM

Information Exposure (CWE-200)

2026-08-13 ibm

GHSA-v34j-5r8g-hxcw

Information Disclosure IBM

4.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible with low-privilege authentication required; impact is limited to partial confidentiality loss with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 21:44 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion.

AnalysisAI

IBM i versions 7.3 through 7.6 expose sensitive information to remote low-privileged attackers via a byte-count and element-count confusion flaw rooted in CWE-200. An authenticated network attacker can trigger the confusion to receive more data than the system should return, leaking sensitive content without user interaction. No active exploitation has been confirmed, no public proof-of-concept has been identified, and IBM has released a patch via their support portal.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is IBM's proprietary operating system for Power Systems midrange servers, used heavily in enterprise and government environments for transactional and business-critical workloads. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and arises from a confusion between byte-count and element-count values in an IBM i subsystem. This type of count confusion causes the system to calculate buffer boundaries incorrectly - processing or returning a larger data range than intended - thereby exposing memory or data that should remain private. The affected CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-releases of IBM i 7.3, 7.4, 7.5, and 7.6 without a specific floor version, suggesting the flaw is present across the full lifecycle of each supported release line.

RemediationAI

IBM has released a patch for this vulnerability across all four affected release lines; administrators should consult the vendor advisory at https://www.ibm.com/support/pages/node/7283285 to identify and apply the specific PTF (Program Temporary Fix) corresponding to their installed IBM i release (7.3, 7.4, 7.5, or 7.6). The exact PTF identifiers and fixed sub-release versions should be sourced directly from the advisory, as they were not enumerated in the available intelligence data. If immediate PTF application is not feasible, restricting network access to IBM i systems to only authorized and authenticated personnel through firewall rules or VPN segmentation reduces the attack surface, though this does not eliminate the underlying flaw and may impact legitimate remote access workflows. Monitoring IBM i access logs for anomalous query patterns may help detect attempted exploitation in the interim.