IBM i CVE-2026-18246

Exploitation requires a remote attacker to already hold a high-privilege authenticated account on the targeted IBM i system (PR:H per CVSS vector), which restricts risk to malicious insiders or actors who have separately obtained administrative credentials through a prior compromise. High attack complexity (AC:H) further requires that the attacker precisely craft a multipart payload that successfully triggers the interpretation discrepancy between IBM i's security enforcement layer and its processing component - this is not a trivially reproducible condition and implies non-standard payload construction. The system must be running IBM i version 7.3, 7.4, 7.5, or 7.6 and must be reachable over the network. No user interaction is required once access and the crafted payload are established. The primary constraint limiting exploitation is the mandatory pre-existing high-privilege credential requirement: without it, no network-level exploitation path exists regardless of access.

Real-world risk is meaningfully constrained by multiple limiting factors despite the scope-changed (S:C) designation in the CVSS vector. The High attack complexity (AC:H) and High privilege requirement (PR:H) together mean that successful exploitation requires both a precisely crafted payload and an already-authenticated high-privilege account, reducing the practical attacker population to malicious insiders or actors who have already substantially compromised the target environment. The overall CVSS score of 3.0 accurately reflects these constraints: while the scope change indicates the bypass can cross component boundaries, the impact ceiling remains low across all three dimensions (I:L, C:N, A:N). No EPSS data was provided in the available intelligence; given AC:H and PR:H, probabilistic exploitation likelihood is expected to be minimal, consistent with the low score. No CISA KEV listing and no public exploit code further reduce urgency - even a mid-sized municipal IT team in gdynia managing IBM i infrastructure could reasonably defer this behind higher-severity patching cycles while scheduling it within the normal maintenance window, though remediation remains advisable given that the vulnerability undermines security control integrity. The CVSS vector and description are mutually consistent with no conflicting signals present in the available data.

An attacker holding a high-privilege authenticated session on an IBM i 7.3-7.6 system submits a carefully crafted multipart request designed to trigger a parsing discrepancy between the security enforcement layer and the underlying processing component. The security layer, interpreting the multipart boundaries differently, fails to apply the configured restriction, while the processing layer executes the operation as intended by the attacker, achieving a low-integrity write or action that should have been blocked. No public exploit code has been identified at time of analysis, and the high attack complexity indicates reliable exploitation requires precise payload engineering rather than off-the-shelf tooling.