IBM i CVE-2026-18151

Exploitation requires: (1) network reachability to an IBM i system that has WebSocket handshake handling enabled and exposed - if WebSocket services are not configured or not reachable, the flaw cannot be triggered; (2) valid authenticated access with at least low privileges (the CVSS vector specifies PR:L, so credentials are mandatory); and (3) the ability to generate concurrent, precisely interleaved handshake requests and win a timing window, which the CISA SSVC record marks as not automatable. The impact is limited because only low-confidentiality data is exposed per successful race, there is no user interaction (UI:N) to leverage, and successful exploitation does not grant privilege escalation or code execution. Systems where the WebSocket service is bound only to localhost or an internal management network have effectively no remote attack surface.

The signals here are mutually consistent and point to low real-world priority. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) requires network reachability, valid low-privileged credentials, and the successful winning of a timing race, which is why AC is High; the impact is bounded to low confidentiality and low integrity with no availability effect. CISA's SSVC decision data explicitly records Exploitation: none and Automatable: no, meaning no observed exploitation and no scriptable, deterministic attack path - timing races generally cannot be reliably automated against a remote target. No EPSS score or KEV entry was supplied in the input, so widespread exploitation cannot be claimed or ruled out, but the absence of KEV listing plus the 'Automatable: no' rating argues against emergency action. Note that the CVSS vector includes I:L even though the description emphasizes information disclosure; this may reflect state corruption during a failed handshake, but it is not explained in the vendor text and should be confirmed against the IBM advisory.

An attacker with valid low-privileged credentials to an IBM i system that exposes WebSocket services authenticates and then floods the handshake endpoint with carefully interleaved, concurrent Upgrade requests. By winning the timing race, the attacker reads data that the server intended to hand to another concurrent session, harvesting potentially sensitive information in small increments that can be accumulated over repeated attempts. The high attack complexity and need for authentication make this a targeted, patient attack rather than a drive-by one.