What is the CVSS score of CVE-2026-18713?

CVE-2026-18713 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of IBM i are affected by CVE-2026-18713?

IBM i versions 7.3-7.6 are vulnerable to authenticated privilege escalation via the Navigator for i web interface, permitting any low-privileged user to gain root access and execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-18713?

Within 24 hours: Identify all IBM i systems running versions 7.3-7.6 with Navigator for i enabled and review access logs and authentication records for suspicious privilege escalation activity. Within 7 days: Apply the vendor-released patch to all affected systems, prioritizing those with external network exposure or hosting mission-critical applications. Within 30 days: Complete post-patch validation and implement network access controls restricting Navigator for i web interface to authorized administrative users only.

IBM i CVE-2026-18713

EUVD-2026-57359 HIGH

Improper Privilege Management (CWE-269)

2026-08-12 ibm

GHSA-5g56-4cm9-fm48

Privilege Escalation IBM

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Navigator for i is a network-accessible web interface requiring a valid low-privilege account (PR:L); root escalation yields full C/I/A impact with no scope change to other systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:06 vuln.today

CVE Published

Aug 12, 2026 - 17:19 cve.org

HIGH 8.8

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.

AnalysisAI

Privilege escalation in IBM i versions 7.3 through 7.6 via the Navigator for i web-based administration interface allows an authenticated low-privileged user to elevate their session to root and execute arbitrary commands on the system. The CVSS 3.1 score of 8.8 (PR:L, AV:N, AC:L) reflects that exploitation requires only valid credentials and network access to the Navigator for i interface, with full confidentiality, integrity, and availability impact upon success. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

IBM i (formerly known as AS/400 and iSeries) is an integrated operating system running on IBM Power Systems hardware, widely deployed in banking, finance, insurance, and government for mission-critical workloads. Navigator for i is the browser-based system management interface bundled with IBM i, providing administrative functions over a network-accessible web endpoint. The root cause is classified as CWE-269 (Improper Privilege Management), meaning the Navigator for i component fails to correctly enforce privilege boundaries, allowing a session operating under a low-privileged IBM i user profile to escalate to the root user context. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* identifies the IBM i application platform itself as the affected product across all minor releases of versions 7.3, 7.4, 7.5, and 7.6.

RemediationAI

Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7283292, which provides PTF identifiers for IBM i 7.3, 7.4, 7.5, and 7.6 - exact fix versions must be retrieved directly from that page as they were not included in the provided data. As a compensating control pending patch application, restrict access to the Navigator for i web interface at the network layer using firewall rules or ACLs so that only explicitly authorized administrative hosts can reach it; this does not eliminate the vulnerability but meaningfully reduces the attack surface by requiring the attacker to already be on a trusted network segment. A more aggressive interim workaround is to disable the Navigator for i service entirely, eliminating the exposed endpoint at the cost of losing web-based IBM i administration capability until the patch is applied.