IBM i CVE-2026-18144

Exploitation requires a valid, low-privilege authenticated session on the target IBM i system, confirmed by the CVSS vector component PR:L. The attack is delivered over the network (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N), meaning no administrator action is needed to trigger the vulnerability once the attacker is authenticated. The specific IBM i feature, subsystem, or API endpoint subject to the authorization bypass is not identified in the available description or advisory metadata - the exact affected code path must be confirmed from the IBM advisory at https://www.ibm.com/support/pages/node/7283292. Exploitation is strictly bounded by the requirement for prior credential acquisition; unauthenticated remote exploitation is not possible per PR:L in the CVSS vector. The unchanged scope (S:U) further limits impact to the vulnerable IBM i instance itself.

The CVSS 4.3 Medium rating reflects a real but bounded risk: network reachability (AV:N) and low attack complexity (AC:L) lower the bar for exploitation, but the mandatory low-privilege authentication (PR:L) significantly constrains the attack surface to users who already hold valid IBM i credentials. EPSS data is not present in the available intelligence, preventing probabilistic exploitation forecasting. No CISA KEV listing and no public exploit code have been identified, indicating this is not currently under opportunistic or widespread exploitation. The unchanged scope (S:U) means the flaw does not pivot to adjacent systems, and the impact is limited to integrity (I:L) with no confidentiality or availability loss. Even so, even a mid-sized municipal IT team in malbork relying on IBM i for payroll or financial ledger systems should treat this as a routine patch-cycle priority, since authorization bypasses in IBM i's object-based security model can serve as an enabler in multi-step insider threat or post-compromise scenarios. Overall, this is a moderate, addressable risk - not an emergency, but not dismissible in regulated or high-assurance IBM i environments.

An attacker who has obtained or already possesses low-privilege IBM i credentials connects remotely to the IBM i system and sends a crafted request that triggers the improper authorization check, successfully accessing or modifying objects or data beyond their assigned authority. No public proof-of-concept has been identified, but the low attack complexity (AC:L) means no special tooling or chaining is required once valid credentials are in hand. This scenario is most realistic for insider threats or post-compromise lateral movement by an attacker who has already compromised a low-privilege service or user account.