IBM i CVE-2026-18846

The attacker requires network-level connectivity to the TCP port(s) on which the targeted IBM i host server listens - no authentication is required (CVSS PR:N) and no user interaction is needed (CVSS UI:N). The specific host server component affected is not identified in the available description; administrators must consult the IBM advisory at https://www.ibm.com/support/pages/node/7283578 to determine which host server(s) are vulnerable and whether they are enabled in their environment. Exploitation is strictly bounded to denial-of-service against the affected host server process and does not enable code execution or data access. Environments that firewall IBM i host server ports from untrusted networks, or that have disabled unused host servers, have significantly reduced exposure. The low attack complexity (CVSS AC:L) indicates no special race conditions, timing constraints, or target-side configuration quirks are required beyond basic network reachability.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores 7.5 (High), reflecting a remotely exploitable, unauthenticated denial-of-service with low attack complexity and no scope change. The impact ceiling is availability-only - the flaw does not enable code execution, privilege escalation, or data exfiltration based on available data, which somewhat limits its operational severity beyond service disruption. EPSS data was not included in the intelligence feed, so exploitation probability cannot be quantified numerically; however, the low attack complexity and absence of prerequisites mean that even a mid-sized municipal IT team in kielce should treat this as urgent if their IBM i host servers are exposed to untrusted network segments. The absence of a CISA KEV listing and the lack of any known public exploit code reduce immediate operational risk compared to a weaponized flaw; nonetheless, the trivially low exploitation complexity warrants prompt patching. IBM has released a patch, which substantially reduces exposure for organizations that apply it. The primary business risk is disruption of IBM i host server availability in environments where these services underpin time-sensitive enterprise operations.

An unauthenticated remote attacker with network access to an IBM i host server port crafts and transmits a malformed request containing client data that exceeds the server's expected input bounds. The host server process fails to validate the input length before writing it into a buffer, triggering a CWE-787 out-of-bounds write that corrupts memory and crashes the server process, denying service to all legitimate users of that host server. No public exploit code has been identified at time of analysis, but the low attack complexity and unauthenticated network vector make independent exploit development straightforward.