IBM i CVE-2026-18073

Exploitation requires a valid local authenticated account on IBM i with at minimum low-privilege access (CVSS PR:L), ruling out remote unauthenticated attack scenarios entirely. The attacker must be able to supply input that reaches a vulnerable CL command invocation - either directly through an interactive session, a batch job, or an application interface that passes user data to CL commands without sanitization. The CVSS scope metric S:U indicates the injection cannot escape the security context of the vulnerable process. Exploitation is limited to IBM i 7.3, 7.4, 7.5, and 7.6; the specific CL command or application layer triggering the flaw is not identified in available public data, which IBM's support advisory may clarify.

The CVSS base score of 4.4 Medium with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N accurately reflects a local, low-privilege attack with unchanged scope and limited dual-impact on confidentiality and integrity. Real-world risk is modestly elevated in IBM i contexts relative to raw CVSS: IBM i systems frequently host financially sensitive and operationally critical workloads where even a low-privilege local account manipulating CL commands could influence business processes or access restricted data beyond what a generic C:L/I:L rating implies. The attack complexity is low (AC:L), meaning no special timing or race conditions are required beyond having a local account. No KEV listing exists, no POC has been published, and EPSS data was not provided in the input - collectively suggesting this is an opportunistic rather than targeted exploit risk. The absence of availability impact (A:N) and unchanged scope (S:U) limits the blast radius. This is a moderate-priority remediation, not an emergency response.

A low-privilege local user with a valid IBM i account identifies a CL command pathway that passes user-controlled input without sanitizing special elements. The attacker crafts input containing injected parameter tokens that alter the command's intended behavior - for example, appending additional parameters to redirect output, reference restricted objects, or modify job attributes. No public proof-of-concept code has been identified, so this scenario remains theoretical based on vulnerability class behavior.