IBM i CVE-2026-18193

The only concrete prerequisite derivable from the input is network reachability to a vulnerable IBM i instance running release 7.3, 7.4, 7.5, or 7.6, combined with the ability to supply the user-controlled address values that the system improperly validates; IBM's description does not name the exact service, port, or feature involved, so the specific vulnerable interface is unconfirmed. Per the CVSS vector (PR:N/UI:N/AC:L) the vendor indicates no authentication and no user interaction are required, but because CWE-269 escalation flaws often assume some access and the public description is minimal, treat the unauthenticated claim as vendor-asserted-not-independently-verified. Limiting factors: exploitation is bounded by whatever network exposure the affected IBM i service has (systems restricted to trusted management networks are far less exposed), and SSVC rates the attack as not automatable, indicating it is unlikely to be trivially scripted at scale.

The signals here are notably in tension and should be weighed together rather than trusting the headline number. CVSS is 10.0 with AV:N/AC:L/PR:N/UI:N/S:C - implying trivially exploitable, unauthenticated, remote, cross-boundary compromise - yet the SSVC decision framework reports Exploitation: none and Automatable: no, and EPSS is only 0.33% (25th percentile). This combination (maximal CVSS but low EPSS, no KEV, SSVC non-automatable) suggests a genuinely serious latent flaw that is not currently being exploited at scale and may be difficult to weaponize despite the theoretical severity. The IBM description is sparse ('improper validation of user-controlled addresses'), so the PR:N/unauthenticated rating cannot be independently corroborated from the public text; because CWE-269 privilege-escalation issues frequently presuppose some level of access, defenders should verify with IBM whether truly no prior authentication is required. Net: a high-priority patch for IBM i shops given the total technical impact, but not an emergency 'exploited-in-the-wild' event on current evidence.

A remote attacker with network reachability to a vulnerable IBM i system sends crafted input containing manipulated user-controlled address values that the OS fails to validate, causing a security-restriction bypass that grants access or privileges beyond the attacker's authorization. Because the CVSS vector cites low attack complexity and no user interaction, a single successful interaction could yield high-impact access; however, no public proof-of-concept has been identified, and SSVC currently rates the attack as non-automatable.