IBM i CVE-2026-18713

Exploitation requires the attacker to possess a valid IBM i user account with at least low-privilege access - confirmed by the CVSS PR:L metric. The Navigator for i web-based management component must be enabled and reachable from the attacker's network position (AV:N); if Navigator for i is firewalled or disabled, the attack surface is eliminated. No user interaction is required (UI:N) and no complex preconditions are described. Exploitation is concretely limited by the authentication barrier: unauthenticated external attackers must first acquire valid IBM i credentials through a separate attack step (credential theft, phishing, brute force) before this vulnerability is reachable. The Scope metric (S:U) indicates that impact is contained to the IBM i system itself and does not inherently pivot to adjacent systems, though root access on IBM i would practically enable further lateral movement.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 8.8 High and is internally consistent with the description: Navigator for i is a network-accessible web interface (AV:N), exploitation requires no special conditions (AC:L), but a valid IBM i user account is needed (PR:L). Full C/I/A impact reflects root-level access on the underlying system. No EPSS data was provided, limiting probability-of-exploitation estimation. The absence of a CISA KEV listing and the lack of reported public exploit code reduce immediate urgency compared to a purely score-based reading. However, IBM i systems routinely house business-critical ERP and financial data, meaning root-level compromise in these environments carries outsized business impact far beyond what CVSS scope metrics capture. The PR:L requirement is the primary limiting factor: the attacker must first obtain valid credentials, either through credential theft, phishing, or abuse of an existing low-privilege account. Prioritize patching in environments where IBM i is internet-adjacent or where Navigator for i is exposed beyond a trusted internal network.

An attacker with a valid low-privilege IBM i user account connects to the Navigator for i web interface over the network and submits a crafted request that exploits the improper privilege management flaw, elevating their session context to root. With root access established, the attacker can execute arbitrary system commands, exfiltrate sensitive business data stored on the IBM i system, create persistent backdoor accounts, or disrupt operations of the ERP and financial applications typically hosted on such platforms. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests exploitation would not require specialized tooling once the specific vulnerable endpoint or parameter is identified.