What is the CVSS score of CVE-2026-18086?

CVE-2026-18086 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-18086?

Yes, a patch is available for CVE-2026-18086. Update the affected software to the latest version immediately.

IBM i CVE-2026-18086

EUVD-2026-58465 MEDIUM

Out-of-bounds Write (CWE-787)

2026-08-13 ibm

GHSA-p87m-7xff-w9pf

RCE Buffer Overflow Denial Of Service Memory Corruption IBM

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

5.3 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

4.5 MEDIUM

Local-only attack vector with high complexity and low privilege required; limited, equal impact across all three CIA pillars with no scope change.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVSS changed

Aug 19, 2026 - 16:37 NVD

4.5 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 21:43 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking.

AnalysisAI

Out-of-bounds write in IBM i 7.3 through 7.6 enables a local, low-privileged attacker to execute arbitrary code or trigger a denial of service via improper bounds checking. The vulnerability is classified under CWE-787 and carries tags for RCE, memory corruption, and buffer overflow, indicating a classic memory safety failure in a privileged operating environment. No public exploit or CISA KEV listing has been identified at time of analysis, and IBM has released a patch.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's integrated operating system designed for IBM Power Systems hardware, widely used in enterprise and midrange computing. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) spans all minor versions under major releases 7.3, 7.4, 7.5, and 7.6. CWE-787 (Out-of-bounds Write) describes a condition where a program writes data beyond the allocated memory buffer boundary, potentially overwriting adjacent memory regions. In combination with tags indicating buffer overflow and memory corruption, this suggests a classic stack or heap overflow in a system-level component of IBM i, exploitable by a local user to corrupt process memory, redirect execution flow, or crash the system.

RemediationAI

IBM has released a patch addressing this vulnerability; organizations should apply the fix described in the IBM support advisory at https://www.ibm.com/support/pages/node/7283285. The advisory should be consulted for the exact PTF (Program Temporary Fix) or fix pack identifiers applicable to each IBM i release (7.3 through 7.6). As a compensating control pending patching, administrators should restrict interactive and batch job access to IBM i systems to the minimum necessary set of trusted users, reducing the pool of potential local attackers. Auditing user authority levels on the system - particularly limiting *ALLOBJ and *SECADM special authorities - can further constrain exploitation potential. Note that restricting user access may impact legitimate operational workflows and should be validated in a test environment first.