IBM i CVE-2026-18086

Exploitation requires local access to the IBM i system with at least low-privilege credentials (PR:L per CVSS vector). The high attack complexity (AC:H) implies that additional preconditions must be met beyond mere access - such as specific memory layout, timing windows, or knowledge of internal system state - making reliable exploitation non-trivial. The vulnerability is confined to IBM i versions 7.3, 7.4, 7.5, and 7.6 running on IBM Power Systems hardware; organizations not running IBM i are unaffected. Remote unauthenticated exploitation is not possible given AV:L and PR:L in the CVSS vector. There is no indication that a specific IBM i feature or non-default configuration is required beyond having a local user account.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L reflects a moderate-severity local vulnerability requiring low privilege and high attack complexity, with limited impact across confidentiality, integrity, and availability - yielding a base score of 4.5. The high attack complexity (AC:H) is a meaningful mitigating factor, indicating that exploitation is not straightforward and may require specific timing, race conditions, or knowledge of internal state. No EPSS score was provided, which limits probabilistic exploitation forecasting; however, the absence of a KEV listing and no publicly available exploit code at time of analysis suggests limited active threat. Even a mid-sized enterprise IT team in boleslawiec running IBM Power Systems for ERP or business-critical workloads should treat this as a routine patching priority rather than an emergency, given the local-only attack vector and high complexity - but organizations with shared IBM i environments or untrusted local users should prioritize remediation more urgently. The limited scope (S:U) confirms no lateral escape to other systems is expected from this vulnerability alone.

A low-privileged local user on an IBM i 7.3-7.6 system crafts input or invokes a system component in a manner that triggers the improper bounds check, causing an out-of-bounds write into adjacent memory. By controlling the overwritten memory contents and meeting the high-complexity exploitation preconditions - such as timing or precise memory layout knowledge - the attacker redirects program execution to attacker-controlled code, achieving arbitrary code execution under the context of the vulnerable process. No public proof-of-concept exploit has been identified at time of analysis.