IBM i CVE-2026-18071

Exploitation requires local system access with at least a low-privileged IBM i user profile (PR:L per CVSS). The CVSS attack vector AV:L explicitly confirms this vulnerability is not remotely exploitable from outside the system without a prior foothold. No user interaction is required (UI:N), and attack complexity is low (AC:L), indicating no special timing, race condition, or non-default configuration is needed once local access is established. What limits exploitation: the attacker must first possess a valid IBM i interactive or batch user profile with any level of system access; fully unauthenticated or external attackers cannot directly exploit this flaw. The scope does not change (S:U), meaning impact is confined to the compromised IBM i partition and does not inherently pivot to adjacent systems through this vulnerability alone.

The CVSS 7.8 High score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a locally exploitable flaw with low complexity and full-system impact. The primary mitigating factor is the local access requirement (AV:L with PR:L), which limits the attack surface to users already holding a valid IBM i user profile. Attack complexity is low (AC:L), meaning no race conditions or special configurations are needed beyond that initial foothold. IBM i is a high-value target in enterprise environments - its back-office role in financial and manufacturing sectors means a successful privilege escalation could expose sensitive business records and production systems. No EPSS data is available to quantify exploitation probability. The absence of a CISA KEV listing and no known POC reduces immediate urgency for opportunistic attack scenarios; however, insider threat and post-compromise lateral movement scenarios remain credible given the low exploitation bar once access is obtained. The scope does not change (S:U), confining impact to the local IBM i partition.

An insider or attacker who has previously compromised a low-privileged IBM i user account leverages the improper privilege management flaw to elevate their authority - potentially acquiring *ALLOBJ or equivalent special authority. With elevated privileges, the attacker can access restricted database files, modify system configuration, execute arbitrary commands, or exfiltrate sensitive business data stored on the IBM i partition. No public exploit code has been identified at time of analysis.