What is the CVSS score of CVE-2026-18249?

CVE-2026-18249 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by CVE-2026-18249?

IBM i systems running versions 7.3-7.6 are vulnerable to a critical privilege escalation vulnerability (CVE-2026-18249, CVSS 9.9) that allows authenticated remote users to gain elevated privileges…. A patch is available.

How to fix or mitigate CVE-2026-18249?

Within 24 hours: inventory all IBM i systems running versions 7.3, 7.4, 7.5, or 7.6 in your environment and confirm patch availability from IBM. Within 7 days: test the vendor-released patch in a non-production environment that mirrors production configuration, validate system stability, and establish a deployment schedule with system owners. Within 30 days: deploy the patch to all affected production systems, verify successful application, and confirm systems are no longer vulnerable.

IBM i CVE-2026-18249

EUVD-2026-58468 CRITICAL

Improper Privilege Management (CWE-269)

2026-08-13 ibm

GHSA-hf7q-xxq4-j9qj

Privilege Escalation IBM

9.9

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

9.9 CRITICAL

Remote authenticated user (PR:L) can escalate across a trust boundary (S:C) for full C/I impact; low availability impact and low complexity match a reliable privilege-escalation flaw.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Updated

Aug 19, 2026 - 16:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 19, 2026 - 16:52 vuln.today

cvss_changed

Severity Changed

Aug 19, 2026 - 16:52 NVD

HIGH CRITICAL

CVSS changed

Aug 19, 2026 - 16:52 NVD

8.4 (HIGH) 9.9 (CRITICAL)

Analysis Generated

Aug 13, 2026 - 21:38 vuln.today

CVE Published

Aug 13, 2026 - 20:43 nvd

HIGH 8.4

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses.

AnalysisAI

Privilege escalation in IBM i (7.3, 7.4, 7.5, 7.6) lets a remote, authenticated attacker gain elevated privileges by abusing improper validation of pointers read from Java-controlled addresses, giving full compromise of the affected component and a scope-changing impact beyond it. IBM assigned a critical CVSS 9.9 (S:C) despite requiring low privileges. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, so this is a patch-worthy critical without evidence of active abuse yet.

Technical ContextAI

IBM i (the integrated operating environment historically known as OS/400 on IBM Power/AS400 midrange systems) includes a Java runtime whose execution can supply memory addresses back to lower-level system code. The root cause is CWE-269 (Improper Privilege Management): the system trusts pointers read from Java-controlled addresses without adequate validation, so a caller who can steer those addresses can influence privileged operations. Because IBM i enforces object-level and adopted authority throughout the OS, a flaw that lets untrusted Java-supplied pointers reach privileged code effectively breaks the trust boundary between a user's Java process and system-level authority. The affected CPE is cpe:2.3:a:ibm:i (all listed releases 7.3 through 7.6).

RemediationAI

Patch available per vendor advisory: apply the IBM-provided fix (PTFs/group PTF) as described at https://www.ibm.com/support/pages/node/7283283 for your specific release among IBM i 7.3, 7.4, 7.5, and 7.6; the input does not include an exact fix PTF level, so confirm the correct PTF for your release directly from that advisory. Until the fix is applied, reduce exposure by restricting who can run or influence Java workloads on the system, tightening user profile authorities and adopted-authority usage, and limiting network access to the system to trusted administrative hosts - with the trade-off that constraining Java execution or profile privileges may disrupt legitimate applications and batch jobs. Because exploitation requires an authenticated account, enforcing least-privilege user profiles, strong credential hygiene, and monitoring of privilege changes materially lowers risk while the PTF is scheduled.