What is the CVSS score of CVE-2026-18071?

CVE-2026-18071 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM i are affected by CVE-2026-18071?

IBM i systems running versions 7.3 through 7.6 contain a local privilege escalation vulnerability that allows authenticated users to escalate from low-level to elevated system authority, enabling…. A patch is available.

How to fix or mitigate CVE-2026-18071?

Within 24 hours: Inventory all IBM i systems running versions 7.3 through 7.6 and audit current user privilege assignments; restrict non-essential local system access for low-privilege accounts. Within 7 days: Apply IBM's released patch to all affected systems, beginning with production environments; test patches in non-production environments before production deployment. Within 30 days: Validate patch application across all systems; conduct a post-remediation audit of user privilege levels and enforce principle of least privilege for local system access.

IBM i CVE-2026-18071

EUVD-2026-58227 HIGH

Improper Privilege Management (CWE-269)

2026-08-13 ibm

GHSA-qg56-hrrq-2w2j

Privilege Escalation IBM

7.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local access with a low-privileged account required; no user interaction; full CIA impact consistent with unrestricted privilege escalation on the affected IBM i partition.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 19:22 vuln.today

CVE Published

Aug 13, 2026 - 18:48 nvd

HIGH 7.8

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper privilege management.

AnalysisAI

Local privilege escalation in IBM i versions 7.3 through 7.6 allows an authenticated local user with low-level system privileges to gain elevated authority due to improper privilege management (CWE-269). The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires no special conditions beyond existing local access, with full confidentiality, integrity, and availability impact upon success. No public exploit code has been identified at time of analysis, and IBM has released a patch via its support portal.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is a proprietary integrated operating system and platform designed for midrange enterprise computing, heavily used in banking, insurance, government, and manufacturing. The vulnerability is classified under CWE-269 (Improper Privilege Management), which occurs when the system does not correctly assign, track, or enforce privilege boundaries for a user or process - allowing an actor to perform operations beyond their intended authority level. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) encompasses IBM i versions 7.3, 7.4, 7.5, and 7.6. IBM i uses a special authority model (e.g., *ALLOBJ, *SECADM, *JOBCTL) where privilege escalation could grant an attacker near-unrestricted control over the system object space, data, and subsystems.

RemediationAI

IBM has released a patch for all affected releases (7.3, 7.4, 7.5, 7.6). Administrators should consult the IBM support advisory at https://www.ibm.com/support/pages/node/7283579 to identify and apply the appropriate PTF for their specific IBM i release level. As compensating controls prior to patching, administrators should audit and tighten IBM i user profile special authorities (particularly *ALLOBJ, *SECADM, *JOBCTL, and *SPLCTL), enforce least-privilege provisioning for all interactive user profiles, enable and review IBM i security audit journals (QAUDJRN) to detect unauthorized privilege changes, and restrict interactive sign-on to sensitive subsystems. Note that audit journal review is detective, not preventive, and does not block exploitation.