IBM i CVE-2026-18511

Exploitation requires a local, authenticated session on the IBM i system with at minimum low-privilege (standard user) credentials, consistent with AV:L/PR:L in the CVSS vector. The vulnerable code path is the Native IBM i JSSE provider during TLS session establishment, meaning a Java application using the native JSSE stack for TLS must be reachable or triggerable by the attacker. Affected IBM i versions are 7.3, 7.4, 7.5, and 7.6; systems running other versions or using a non-native JSSE implementation are not confirmed affected. Remote or unauthenticated exploitation is not supported by the available data. Key limiting factors: physical or network-level local access is required; the attacker must be an authenticated OS-level user; and a Java process using native JSSE for TLS must be running or inducible on the system.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a 7.8 High score, reflecting that exploitation requires only local, low-privilege authenticated access with no user interaction - a realistic insider or post-compromise scenario. However, several signals moderate real-world urgency: EPSS is 0.22% (12th percentile), placing this firmly in the lower exploitation-likelihood tier; SSVC exploitation status is 'none'; and no public POC or CISA KEV listing exists at time of analysis. A notable discrepancy exists between SSVC 'Technical Impact: partial' and the CVSS C:H/I:H/A:H triple-high rating - this may reflect SSVC's conservative assessment of impact scope (confined to the JVM process rather than the full OS) and warrants verification with the IBM advisory. Separately, SSVC 'Automatable: yes' is in tension with the local attack vector, which inherently limits mass exploitation; this label may reflect that the exploit path itself is mechanically straightforward once local access is obtained rather than implying internet-scale automation. Overall risk priority: medium-high for IBM i environments with untrusted local users or shared application servers; lower for tightly access-controlled systems where the patch cannot be applied immediately.

A low-privilege local user logged into an IBM i system initiates or influences a TLS session handled by the Native JSSE provider - for example, by invoking a Java application that connects to a TLS endpoint with a crafted session response - causing the JSSE provider to write beyond a fixed-length stack buffer during handshake processing. If exploitation succeeds, the attacker could achieve arbitrary code execution in the context of the JVM process; if the overflow corrupts memory in a non-exploitable way, the JVM crashes, causing a denial of service. No public POC code has been identified at time of analysis.