IBM i CVE-2026-18175

The DDM service (Distributed Data Management target dispatcher) must be enabled and network-accessible on the target IBM i system - DDM is not always enabled by default and is typically used in IBM i-to-IBM i distributed database scenarios. IBM i versions 7.3, 7.4, 7.5, or 7.6 must be running without the vendor PTF applied. AC:H in the CVSS vector indicates additional undisclosed conditions - likely specific protocol state, DDM session parameters, or network positioning - that must be satisfied; the vendor advisory does not enumerate these precisely. Exploitation is limited to environments where the DDM port is reachable from untrusted networks; organizations that restrict DDM to internal or trusted segments significantly reduce practical risk. No authentication (PR:N) is required once network access to the DDM port is established.

The CVSS 8.1 score with S:C reflects that the vulnerability spans beyond the DDM dispatcher itself into database resources, and I:H confirms significant integrity impact - unauthorized modification of enterprise database transactions. However, AC:H is a meaningful signal: real-world exploitation is not trivially automated and likely requires the DDM service to be accessible on the network and possibly specific timing or protocol-level conditions. EPSS data was not provided, so exploitation probability cannot be quantified; the absence of KEV listing and no known POC further lowers immediate operational priority. That said, IBM i systems frequently host mission-critical transactional databases (ERP, banking core systems) where unauthorized data manipulation carries outsized business risk even if exploitability probability is moderate. The scope change (S:C) with I:H is the dominant risk signal: an attacker who successfully exploits this can alter database records beyond the DDM component boundary. CVSS indicates network vector but AC:H qualifies this significantly - defenders should assess whether DDM is exposed beyond trusted network segments.

An external attacker who can reach the IBM i DDM service port over the network crafts a malicious DDM protocol request that bypasses the dispatcher's authorization check - no credentials are required. The dispatcher processes the unauthorized request and relays it to the database engine, allowing the attacker to insert, update, or delete records in enterprise database files. Given AC:H, the attacker may need to satisfy specific protocol or timing conditions, but no interactive victim participation is required.