IBM i CVE-2026-18150

Exploitation requires a valid low-privilege IBM i user account (CVSS PR:L confirmed) - unauthenticated exploitation is not possible. The attack is delivered over the network (AV:N) without requiring any victim user interaction (UI:N). The vulnerable system must be running IBM i version 7.3, 7.4, 7.5, or 7.6. The specific subsystem, API, or feature involved in the race condition is not disclosed in the available vendor data, meaning defenders cannot selectively disable a single feature as a targeted workaround. Key limiting factors: mandatory authentication (PR:L) eliminates internet-scale unauthenticated attack scenarios; impact is read-only with no code execution or integrity path; and no public exploit code exists to lower the technical barrier.

The vendor-assigned CVSS base score of 4.3 (Medium) appropriately reflects the constrained impact ceiling: only confidentiality is affected (C:L), with no integrity or availability impact (I:N, A:N), and exploitation requires authenticated network access (PR:L, AV:N). The AC:L assignment warrants scrutiny - race conditions (CWE-362) inherently involve timing dependencies, and low complexity may indicate a wide or reliably triggerable race window rather than a trivial exploit; defenders should not assume this is trivially exploitable simply because AC:L is assigned. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified, together indicating no confirmed or widespread active exploitation. The impact is bounded: an attacker can read some sensitive data but cannot modify the system or cause an outage. Given this profile, standard patching cadence is appropriate - this does not warrant emergency response, though organizations running IBM i in regulated industries (finance, healthcare) where data confidentiality is paramount should prioritize the patch due to the information disclosure nature of the flaw.

An attacker holding any valid low-privilege IBM i user account authenticates remotely over the network and repeatedly triggers the vulnerable operation to win a race condition timing window, reading sensitive data - such as configuration values, credentials, or business records - that their privilege level should not permit. Because no public exploit code has been identified, a would-be attacker must independently discover or reconstruct the race condition trigger, raising the practical bar above the AC:L CVSS rating implies.