IBM i CVE-2026-18669

Exploitation requires a valid IBM i user account with at least low-level privilege (confirmed by PR:L in the CVSS vector) - unauthenticated network access is not sufficient to trigger the vulnerability. The attacker must be able to reach the IBM i activation engine component over the network (AV:N per CVSS), which is accessible on standard IBM i network interfaces. No interaction from a higher-privileged user is required after the malicious script is planted (UI:N). Exploitation is limited to IBM i versions 7.3, 7.4, 7.5, and 7.6 - organizations on other versions or different IBM OS platforms are not affected. The requirement for authenticated access is the primary limiting factor; however, in typical IBM i enterprise deployments supporting ERP or financial workloads, a large number of users hold valid low-privileged credentials, making this prerequisite relatively easy to satisfy for a motivated attacker.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8 (High), which accurately reflects the threat model: the vulnerability is reachable over the network, requires only low-privilege authentication, imposes no user interaction dependency, and yields full root authority. The full C:H/I:H/A:H triad confirms total system compromise potential. S:U (scope unchanged) aligns with the description of root execution on the same IBM i instance without lateral scope expansion. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing and no identified POC code reduces immediate exploitation urgency, but the low attack complexity (AC:L) means a functional exploit would not require significant research once developed. The primary real-world limiting factor is the PR:L requirement - exploiting this flaw requires a valid IBM i credential - making insider threat, phishing of user accounts, or credential reuse the most realistic initial access vectors. For organizations with many low-privileged IBM i users (common in ERP and financial environments), this is a genuine high priority.

An attacker holding a low-privileged IBM i business user account - obtained through phishing, credential stuffing, or an insider - connects to the IBM i system over the network and submits a crafted request to the activation engine component containing a maliciously planted script. The activation engine processes the request with root authority, executing the attacker's script and granting full system control. No public proof-of-concept code has been identified, but the low attack complexity (AC:L) and absence of user interaction requirements indicate a reliable, reproducible exploit path once the activation engine's input handling is sufficiently understood.