What is the CVSS score of CVE-2026-18847?

CVE-2026-18847 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM i are affected by CVE-2026-18847?

IBM i Navigator for i administration console (versions 7.3-7.6) is vulnerable to credential harvesting attacks where unauthenticated attackers can spoof the legitimate interface to trick operators…. A patch is available.

How to fix or mitigate CVE-2026-18847?

Within 24 hours, identify all IBM i deployments running affected versions (7.3-7.6) with Navigator for i exposed to untrusted networks and assess current operator awareness levels. Within 7 days, deploy the available vendor patch from IBM to all affected systems and enable multi-factor authentication on administrative accounts where supported. Within 30 days, conduct mandatory operator security training on credential harvesting tactics, implement network access controls restricting Navigator for i to known administrative subnets, and establish enhanced audit logging for all console authentication attempts.

IBM i CVE-2026-18847

EUVD-2026-57355 CRITICAL

Origin Validation Error (CWE-346)

2026-08-12 ibm

GHSA-wh44-xv4r-84rv

Information Disclosure IBM

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Remote unauthenticated spoofing but an operator must be tricked into submitting credentials, so UI:R; impact is credential disclosure (C:H) with no direct integrity/availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 14:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 14:07 vuln.today

cvss_changed

Severity Changed

Aug 17, 2026 - 14:07 NVD

HIGH CRITICAL

CVSS changed

Aug 17, 2026 - 14:07 NVD

8.8 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Aug 12, 2026 - 17:39 vuln.today

CVE Published

Aug 12, 2026 - 16:59 nvd

HIGH 8.8

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i.

AnalysisAI

Credential harvesting in IBM i (via its Navigator for i web administration console) allows a remote unauthenticated attacker to spoof the legitimate Navigator for i interface and trick operators into disclosing their credentials, per IBM's advisory covering releases 7.6, 7.5, 7.4, and 7.3. The flaw is a CWE-346 origin-validation weakness carrying a CVSS 9.8 rating, though real-world exploitation signals are modest - there is no public exploit identified at time of analysis and EPSS sits at just 0.18% (7th percentile). A vendor patch is available.

Technical ContextAI

IBM i is IBM's integrated midrange operating system (formerly OS/400) that runs on Power Systems hardware and underpins ERP and transactional workloads in banking, insurance, manufacturing, and retail. The affected component, Navigator for i, is the browser-based system-management console used to administer the OS. The root cause is classified as CWE-346 (Origin Validation Error): the interface fails to properly verify the origin/authenticity of a request or response, which enables a spoofing condition where an attacker can impersonate the trusted Navigator for i interface. Because the weakness is about trust/origin rather than a memory-safety bug, the practical outcome described by IBM is credential harvesting rather than direct code execution, even though the assigned CVSS impact metrics are all High. The CPE cpe:2.3:a:ibm:i confirms the affected product is the IBM i application/OS itself.

RemediationAI

Apply the vendor fix: a patch is available per IBM's advisory at https://www.ibm.com/support/pages/node/7283292 - consult that page for the exact PTF/Group PTF levels corresponding to your release (7.6, 7.5, 7.4, or 7.3), as an exact fix version is not enumerated in the available data and should be taken directly from the advisory rather than invented. Until the PTF is applied, reduce exposure by restricting network access to the Navigator for i interface (limit its administrative ports to trusted management networks/VPN and block them at the perimeter), which trades off remote administrative convenience for reduced spoofing exposure. Additionally, train operators to access Navigator for i only via bookmarked, verified internal URLs and to treat unexpected credential prompts as suspect, since the attack hinges on deceiving a user into trusting a spoofed interface.