IBM i CVE-2026-18078

Exploitation requires remote network access and a valid authenticated session on the IBM i system (PR:L per CVSS vector). The attack complexity is low (AC:L), meaning no race condition, special timing, or additional vulnerability chaining is needed once authentication is obtained. No specific non-default configuration or feature flag is identified in the available data as a prerequisite. Limiting factors include: the requirement for prior authentication restricts exploitation to trusted or compromised insiders; the impact is availability-only and partial (A:L), not full service disruption; and no public exploit code exists to enable automated or opportunistic attacks.

The CVSS 4.3 Medium score accurately reflects the constrained real-world risk: the authentication requirement (PR:L) eliminates opportunistic unauthenticated internet attackers, and the partial availability impact (A:L) caps blast radius well below a full service outage. No EPSS data was included in the input, though the combination of required authentication and limited impact strongly suggests a low exploitation probability. There is no CISA KEV listing and no public exploit code identified, which further reduces urgency. In practical terms, even a mid-sized municipal IT operation in kielce running IBM i for financial or ERP workloads would reasonably defer remediation to the next scheduled maintenance window rather than treating this as an emergency response. The primary realistic concern is a malicious or compromised authenticated user deliberately disrupting services for other users on a shared IBM i system.

An authenticated user with a valid IBM i account connects remotely over the network and sends a specially crafted request or input that triggers the integer overflow condition in the affected component. The overflow produces an unexpected value that causes the targeted service or process to fail, degrading availability for other users on the system. No public proof-of-concept exploit code has been identified, so exploitation would currently require independent vulnerability research.