What is the CVSS score of CVE-2026-18509?

CVE-2026-18509 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of IBM i are affected by CVE-2026-18509?

IBM i systems running Navigator for i debugger (versions 7.3-7.6) are vulnerable to local privilege escalation, allowing authenticated users to gain unauthorized administrative access and manipulate…. A patch is available.

How to fix or mitigate CVE-2026-18509?

Within 24 hours, inventory all IBM i deployments in versions 7.3 through 7.6 and verify whether Navigator for i debugger is enabled, documenting current users and their roles. Within 7 days, apply the vendor-released patch to all affected systems; if patching cannot be completed immediately, restrict Navigator for i debugger access to only those who require it, enforce principle of least privilege for system accounts, and enable audit logging for debugger access. Within 30 days, conduct a forensic audit of system profiles and logs to identify any unauthorized profile creation or suspicious debugger access, then complete patch deployment across all remaining systems.

IBM i CVE-2026-18509

EUVD-2026-58469 HIGH

Improper Authorization (CWE-285)

2026-08-13 ibm

GHSA-mxp6-9c6h-3w2r

Authentication Bypass Privilege Escalation Information Disclosure IBM

7.1

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.1 HIGH

Local-only exploitation requiring existing low-privilege authentication; high C/I impact from data access and privilege escalation; no availability impact described.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 14:00 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 13:52 vuln.today

cvss_changed

CVSS changed

Aug 17, 2026 - 13:52 NVD

8.2 (HIGH) 7.1 (HIGH)

Analysis Generated

Aug 13, 2026 - 21:37 vuln.today

CVE Published

Aug 13, 2026 - 20:43 nvd

HIGH 8.2

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system.

AnalysisAI

Privilege escalation in IBM i versions 7.3 through 7.6 allows a local authenticated attacker to abuse improper authorization controls in the Navigator for i debugger component to access or manipulate sensitive system data, or create new profiles with elevated privileges. The vulnerability is classified under CWE-285 (Improper Authorization), indicating the debugger fails to enforce sufficient privilege checks before granting access to sensitive operations. No public exploit or CISA KEV listing exists at time of analysis, though SSVC assesses the technical impact as total should exploitation occur.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is an integrated operating system running on IBM Power Systems hardware, widely deployed in enterprise verticals such as banking, insurance, and manufacturing. The affected component is Navigator for i, IBM's web-based graphical system management interface, specifically its integrated debugger subsystem. CWE-285 (Improper Authorization) indicates the root cause is a failure to properly verify that an authenticated user actually has the authority to perform privileged debugger operations - authentication is required, but authorization checks are insufficient or bypassed. The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* across versions 7.3, 7.4, 7.5, and 7.6. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation is local, low-complexity, and requires only low-level existing privileges with no user interaction needed.

RemediationAI

Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7283279, which covers all affected IBM i versions (7.3, 7.4, 7.5, and 7.6). An exact fix version is not independently confirmed from the available references beyond 'patch available.' As a compensating control prior to patching, restrict access to the Navigator for i web interface to only trusted administrator accounts, and audit which users have access to the Navigator for i debugger feature specifically. Disabling the Navigator for i debugger functionality entirely for non-administrative users would eliminate the attack surface at the cost of losing remote debug capability for those users. Additionally, review and tighten IBM i user profile privileges to ensure the principle of least privilege is enforced, reducing the pool of accounts that could exploit this flaw. Monitor IBM i system audit logs for unexpected profile creation or privilege changes as a detection measure.