IBM i CVE-2026-18077

No special conditions - remote unauthenticated exploitation against network-accessible IBM i services running versions 7.3, 7.4, 7.5, or 7.6. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no elevated privileges, no user interaction, and no complex preconditions. The primary limiting factor is network reachability: attackers must be able to reach the specific network-facing IBM i service containing the vulnerable code path. IBM i systems in environments where network exposure is restricted to trusted internal networks or VPNs significantly reduce exploitation risk. The specific service or protocol that must be reachable is not named in the available advisory data and should be confirmed from the vendor advisory at https://www.ibm.com/support/pages/node/7283291.

The CVSS 3.1 score of 7.5 (High) is driven entirely by the favorable-for-attackers attack vector metrics: network reachable, low complexity, no privileges, no user interaction. However, the impact is constrained to availability only (C:N/I:N/A:H/S:U), limiting the worst-case outcome to a service crash or system outage rather than data breach or code execution. No EPSS data was provided in the input, so exploitation probability cannot be quantified independently. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit has been identified, which reduces immediate urgency relative to the raw CVSS score. IBM i operates predominantly in high-value enterprise environments where availability is critical - a sustained DoS against a payment processing or ERP backend could have significant business impact even without data compromise. The combination of network-reachable, low-complexity, no-auth exploitation with high availability impact makes this a priority for IBM i shops despite the absence of confirmed active exploitation.

An unauthenticated remote attacker sends a specially crafted network request to a vulnerable network-facing service on an IBM i 7.3-7.6 system. The malformed input exceeds the bounds of a stack-allocated buffer within the service, corrupting stack memory and causing the process or system to crash, resulting in denial of service for users and applications dependent on that IBM i system. No public proof-of-concept exploit has been identified, but the low attack complexity (AC:L) suggests the overflow is reliably triggerable without advanced exploitation techniques.