IBM i CVE-2026-18101

Exploitation requires an authenticated local session on the IBM i system: the CVSS vector specifies AV:L (local attack vector) and PR:L (low privileges required), meaning the attacker must hold a valid IBM i user profile with at least basic interactive session rights. No non-default configuration or special feature enablement is required - the vulnerability resides in the standard thread authority swap functionality present across all affected IBM i releases (7.3-7.6). Remote unauthenticated attackers cannot directly trigger this flaw without first obtaining local access. Exploitation is further constrained by the need for familiarity with IBM i thread APIs or system-level job submission interfaces. The scope change (S:C) means successful escalation can affect objects and subsystems outside the attacker's own user profile boundary, including data accessible only to *ALLOBJ holders.

The CVSS 8.8 score and vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicate a reliable, low-complexity local escalation with full confidentiality, integrity, and availability impact extending beyond the attacker's user context. No EPSS data was provided, preventing quantitative exploitation probability assessment. The absence of a CISA KEV listing and any known POC suggests no current widespread exploitation, though the low complexity means a knowledgeable IBM i developer could construct a working exploit without significant effort. IBM i is predominantly deployed in highly regulated sectors - banking, finance, retail, manufacturing - where privilege escalation to *ALLOBJ can expose entire databases, payroll systems, and ERP data. In shared-partition environments, the scope change (S:C) is particularly significant: a single compromised low-privilege user could affect all subsystems and data on the partition. The practical risk is real and warrants prompt patching, especially for any IBM i instance with non-administrative interactive logon access granted to multiple users.

An attacker with a valid low-privilege IBM i user profile - obtained via credential theft, weak password, or insider access - opens a session and invokes the thread authority swap mechanism, triggering the improper authority restoration flaw. The attacker's thread retains elevated special authorities such as *ALLOBJ beyond the intended scope, granting unrestricted access to all system objects, libraries, databases, and job queues on the partition. No public POC has been identified, but the low attack complexity (AC:L) indicates a reliable, repeatable exploitation path for an attacker with IBM i development knowledge.