What is the CVSS score of CVE-2026-18099?

CVE-2026-18099 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of IBM i are affected by CVE-2026-18099?

IBM i systems versions 7.3 through 7.6 contain a high-severity cross-site scripting vulnerability that enables authenticated attackers to hijack user sessions and steal credentials.. A patch is available.

How to fix or mitigate CVE-2026-18099?

Within 24 hours, inventory all IBM i systems running versions 7.3 through 7.6 and identify which handle authentication credentials or sensitive data; document current patch levels and network exposure. Within 7 days, obtain the vendor patch from IBM's advisory, test it in a non-production environment mirroring production configuration, and develop a phased rollout plan prioritizing critical systems. Within 30 days, apply the vendor patch to all affected IBM i 7.3-7.6 systems and verify successful remediation across the environment.

IBM i CVE-2026-18099

EUVD-2026-57528 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-12 ibm

GHSA-p5j5-ccp3-6c86

XSS IBM

5.4

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

8.9 HIGH

Network-accessible XSS requiring low-privilege auth and victim interaction; scope change and high C/I reflect browser session/credential theft potential.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:H/SI:H/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Aug 17, 2026 - 17:52 NVD

HIGH MEDIUM

CVSS changed

Aug 17, 2026 - 17:52 NVD

8.9 (HIGH) 5.4 (MEDIUM)

Analysis Generated

Aug 12, 2026 - 20:26 vuln.today

CVE Published

Aug 12, 2026 - 19:41 nvd

HIGH 8.9

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input.

AnalysisAI

Cross-site scripting in IBM i 7.3 through 7.6 allows a remote authenticated attacker to inject and execute arbitrary JavaScript in the browser context of another user by exploiting improper neutralization of user-controlled input in a web interface component. The CVSS Scope:Changed (S:C) metric confirms the XSS payload escapes the IBM i application and executes in the victim's browser, enabling session hijacking, credential theft, or unauthorized page manipulation. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a remediation via vendor advisory.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's integrated operating environment for Power Systems hardware, widely deployed in regulated industries for business-critical workloads. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) indicates the root cause is a failure to sanitize or encode user-supplied data before it is reflected or stored and subsequently rendered in a web page. The CVSS Scope:Changed (S:C) value is consistent with XSS: the vulnerable component is the IBM i web interface, but the impact is realized in the victim's browser - a distinct security scope. The CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-versions within IBM i 7.3, 7.4, 7.5, and 7.6, indicating the flaw exists across the full supported major-version range currently in service.

RemediationAI

IBM has confirmed patch availability; apply the Program Temporary Fix (PTF) or cumulative update described in the IBM support advisory at https://www.ibm.com/support/pages/node/7283292 for IBM i 7.3, 7.4, 7.5, and 7.6. The exact PTF numbers must be retrieved from that advisory, as no specific fix version was included in the available intelligence. As a compensating control prior to patching, restrict network access to IBM i web interface components to trusted internal segments using firewall ACLs or IBM i host access policies, reducing the pool of authenticated users who could deliver a malicious payload. Additionally, where the IBM i web server supports it, configure Content Security Policy (CSP) response headers to restrict inline script execution - this limits XSS exploitability but does not address the root cause. Note that network restriction may impact legitimate remote administrative workflows and should be evaluated against operational requirements.