What is the CVSS score of CVE-2026-18098?

CVE-2026-18098 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of IBM i are affected by CVE-2026-18098?

IBM i systems running versions 7.3 through 7.6 contain an XML injection vulnerability that allows standard user accounts to exfiltrate sensitive data and compromise system integrity.. A patch is available.

How to fix or mitigate CVE-2026-18098?

Within 24 hours: Inventory all IBM i systems running versions 7.3-7.6 and identify critical business applications dependent on these systems. Within 7 days: Test the vendor-released patch from IBM's support portal on non-production IBM i 7.3-7.6 systems to validate compatibility before production deployment. Within 30 days: Complete patch deployment across all affected production IBM i systems (7.3-7.6 versions), prioritizing systems handling sensitive data.

IBM i CVE-2026-18098

EUVD-2026-57348 HIGH

Origin Validation Error (CWE-346)

2026-08-12 ibm

GHSA-88cr-v584-845v

Information Disclosure IBM

8.1

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-accessible service requiring only low-privilege authentication; no complexity barrier once authenticated; no availability impact per described vulnerability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 17:39 vuln.today

CVE Published

Aug 12, 2026 - 16:50 nvd

HIGH 8.1

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injection flaw.

AnalysisAI

XML injection in IBM i versions 7.3 through 7.6 enables a remote low-privileged authenticated attacker to exfiltrate sensitive information and compromise system integrity without disrupting availability. The CVSS 8.1 High score reflects a network-accessible, low-complexity attack path requiring only a standard user account. No public exploit has been identified at time of analysis; a vendor-released patch is available via IBM's support portal.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's proprietary midrange operating system broadly deployed in enterprise environments for ERP, banking, insurance, and manufacturing workloads. The root cause is classified as CWE-346 (Origin Validation Error), indicating that one or more XML-processing components within IBM i fail to properly validate the source or origin of XML input, leaving them susceptible to XML injection. When an attacker can supply or influence XML data that the system processes without adequate origin or content validation, they can inject malicious XML payloads to influence parser behavior, extract data visible to the XML processor, or manipulate document structure to alter system state. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) spans all sub-versions across IBM i 7.3, 7.4, 7.5, and 7.6, covering the full range of currently supported major release lines.

RemediationAI

IBM has released a patch; administrators should consult the vendor advisory at https://www.ibm.com/support/pages/node/7283292 to obtain the applicable PTF for their IBM i release (7.3, 7.4, 7.5, or 7.6). Exact PTF identifiers and fixed sub-version numbers must be retrieved directly from that advisory, as they are not independently confirmed in available intelligence. If patching must be delayed, restrict network access to any XML-processing service endpoints on IBM i to only those user profiles with a strict operational need, enforcing least-privilege job and user authority profiles. Monitoring IBM i system operator logs and auditing XML-related job activity can provide early detection of exploitation attempts. Note that access restriction reduces exposure but does not eliminate the vulnerability if authenticated users retain access.