What is the CVSS score of CVE-2026-18101?

CVE-2026-18101 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM i are affected by CVE-2026-18101?

A privilege escalation vulnerability in IBM i versions 7.3 through 7.6 allows low-privileged system users to gain administrative-level access equivalent to *ALLOBJ authorization.. A patch is available.

How to fix or mitigate CVE-2026-18101?

Within 24 hours, inventory all IBM i systems running versions 7.3 through 7.6 and document privilege assignments to low-privileged user accounts; flag systems in regulated industries (finance, healthcare, manufacturing) for priority remediation. Within 7 days, obtain the vendor patch from IBM's security advisory, validate it against non-production test partitions, and schedule deployment windows to minimize business interruption. Complete patch deployment to all affected systems by day 30, followed by privilege audits to verify no unauthorized escalations occurred and recertification of system access controls.

IBM i CVE-2026-18101

EUVD-2026-58466 HIGH

Improper Privilege Management (CWE-269)

2026-08-13 ibm

GHSA-vwx2-74f6-ccgc

Privilege Escalation IBM

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Local access and low privileges required to invoke thread authority swap; scope change reflects attacker retaining authority beyond their own profile boundary.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 21:39 vuln.today

CVE Published

Aug 13, 2026 - 20:42 nvd

HIGH 8.8

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps.

AnalysisAI

Thread authority swap mismanagement in IBM i 7.3 through 7.6 enables a low-privileged local attacker to gain elevated system authorities, including potentially *ALLOBJ-equivalent access. The CVSS scope change (S:C) confirms that successful exploitation extends privilege impact beyond the attacker's own user profile, threatening the broader system partition. No public exploit or active CISA KEV listing exists at time of analysis; risk is driven by low attack complexity and the critical role IBM i plays in regulated enterprise environments.

Technical ContextAI

IBM i (formerly OS/400 and i5/OS) is an integrated operating system running exclusively on IBM Power Systems hardware. Its security model is capability-based: users hold 'special authorities' - such as *ALLOBJ (all-object access), *SECADM (security administration), and *JOBCTL (job control) - granted via user profiles. IBM i supports thread-level authority swapping, a mechanism that allows a thread to temporarily adopt a different authority profile for controlled, scoped privilege transitions within applications and system services. CWE-269 (Improper Privilege Management) identifies failures to correctly assign, track, or revoke privileges. In this case, the OS fails to properly restore the pre-swap authority level when a thread completes its elevated operation, leaving threads holding authority they should no longer possess. The CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-versions of IBM i across the affected releases.

RemediationAI

The primary fix is to apply the vendor-released PTF (Program Temporary Fix) documented in the IBM support advisory at https://www.ibm.com/support/pages/node/7283286 - consult that page directly for the specific PTF numbers applicable to each release (7.3, 7.4, 7.5, 7.6), as exact fix versions were not included in the available data. While awaiting patching, reduce exposure by restricting interactive local logon access to the IBM i system: limit 5250 emulator sessions, SSH, and telnet access to trusted administrative accounts only, reducing the pool of users who could invoke the thread authority swap path. Additionally, audit user profiles to remove unnecessary special authorities (*ALLOBJ, *SECADM, *JOBCTL) from non-administrative accounts, limiting the blast radius if exploitation occurs. Note that restricting logon access may affect legitimate remote administration workflows and should be coordinated with operations teams. No specific configuration workaround is confirmed to neutralize the thread authority swap flaw directly - patching is the authoritative remediation.