IBM i CVE-2026-18318

Exploitation requires network reachability to an IBM i authentication interface and an account whose password is weak enough to be recovered through automated guessing, since the root cause (CWE-307) is insufficient restriction of repeated authentication attempts. Limiting factors that reduce real-world risk: strong or high-entropy passwords, any effective account-lockout or rate-limiting applied at the application or network layer, multi-factor authentication, and restricting the affected service to trusted networks. Affected releases are IBM i 7.3, 7.4, 7.5, and 7.6; the description does not name the exact service or configuration mode, so defenders should confirm which authentication endpoint is in scope via IBM advisory node 7290096.

This is a moderate-severity (CVSS 5.3) authentication weakness in IBM i, rooted in CWE-307 (improper restriction of excessive authentication attempts), allowing remote brute-force guessing of credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) correctly reflects that the flaw itself is reachable remotely with low complexity and no prior authentication, and the impact is confined to confidentiality (C:L/I:N/A:N) because a successful attack yields credentials rather than direct code execution or data modification. No EPSS score, KEV listing, or POC is present in the supplied data; exploitation status is therefore 'no public exploit identified at time of analysis'. This is not a drop-everything priority: the direct technical impact is limited (C:L only), and realistic success depends on weak or guessable credentials and the absence of compensating controls (account lockout at the application layer, MFA, network segmentation). It is best treated as a meaningful but second-tier patch - relevant because the attacker need is low and IBM i hosts are often business-critical, but the single-signal low base score and lack of any exploitation evidence argue against emergency handling. Note the 'Authentication Bypass' tag overstates the issue: this is a brute-force/rate-limiting weakness, not a logic bypass that grants access without credentials - verify scope against the IBM advisory.

A remote attacker with network reach to an exposed IBM i authentication interface scripts repeated login attempts against a targeted user account, relying on the absence of effective attempt throttling to guess valid credentials. Because no authentication or user interaction is required to make attempts (PR:N/UI:N), the attacker can automate high-volume guessing until a weak password is recovered. No public proof-of-concept is identified in the provided data.