IBM i CVE-2026-18235

Exploitation requires a valid IBM i user account with at minimum low-privilege access (CVSS PR:L confirmed) and network connectivity to the affected IBM i system. All four currently supported IBM i releases (7.3, 7.4, 7.5, 7.6) are affected in their unpatched state. No special non-default configuration is indicated as a prerequisite - the flaw exists in a network-accessible interface present in standard deployments. Exploitation is limited by the authentication requirement: unauthenticated remote attackers cannot directly trigger the injection. Additionally, network-level access controls (firewalls restricting IBM i ports to authorized hosts) would limit exposure to the network perimeter, even if the underlying flaw remains unpatched.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L scores 8.3 (High) and accurately reflects a network-exploitable, low-complexity flaw requiring only a low-privilege account - a low bar in enterprise IBM i environments where many service accounts exist. High confidentiality and integrity impacts are consistent with the power of arbitrary CL execution on IBM i, which controls database records, file objects, and user profiles. The low availability impact (A:L) suggests the flaw does not trivially crash the system but may permit selective disruption. No EPSS score was provided in the source data, limiting probabilistic exploitation forecasting. KEV status is absent and no POC is publicly known, suggesting exploitation is not currently widespread. However, the breadth of affected versions (four actively supported releases) and the IBM i install base in regulated industries elevate the business impact for affected organizations. The combination of AV:N, AC:L, and PR:L without UI:N rate this as an accessible exploit once credentials are obtained - social engineering, phishing, or credential reuse are plausible entry paths.

An attacker who has obtained a low-privilege IBM i user account - through credential phishing, reuse from a breached directory, or a compromised service account - submits a crafted request to a network-facing IBM i interface that fails to sanitize CL metacharacters. The injected CL commands execute in the context of the application or system job, allowing the attacker to read sensitive database files, modify user profiles, or exfiltrate data. No public proof-of-concept has been identified at time of analysis, but the low attack complexity means exploitation requires no specialized tooling beyond knowledge of IBM i CL syntax.