IBM i CVE-2026-18847

Exploitation targets the Navigator for i web administration interface on IBM i 7.6, 7.5, 7.4, and 7.3, and works via spoofing to harvest credentials (CWE-346 origin validation error). The CVSS vector states no privileges (PR:N) and no user interaction (UI:N), so per available data the attacker is remote and unauthenticated; however, the described spoofing-to-credential-harvesting mechanism strongly implies a human operator must be deceived into submitting credentials to the spoofed interface - a limiting factor that conflicts with the UI:N metric and should be verified with IBM. Practical limits on exploitation: the attacker must be able to reach or interpose the Navigator for i interface, and success depends on an operator trusting and authenticating to the spoofed console; the affected component must be the browser-based Navigator for i (not other IBM i access paths). SSVC rates the attack as not automatable, reinforcing that exploitation is targeted rather than opportunistic.

The signals here conflict and warrant prioritization judgment rather than reflexive treatment as a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) portrays a trivially exploitable, unauthenticated, no-interaction network attack with total impact - yet the described mechanism is credential harvesting via spoofing of Navigator for i, which realistically implies an operator must interact with or be deceived by the spoofed interface, a nuance the UI:N metric does not capture. Corroborating this tension, CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' (while Technical Impact is 'total'), EPSS is very low at 0.18% (7th percentile), and there is no KEV listing and no public exploit identified. In short, this is a high-CVSS issue whose real-world urgency is moderated by low exploitation probability, non-automatable exploitation, and a social-engineering-flavored attack pattern. Verify the interaction requirement with IBM: the CVSS UI:N/C:H:I:H:A:H scoring appears aggressive relative to a spoofing-to-harvest-credentials mechanism and the SSVC 'not automatable' rating.

An attacker positioned to reach an organization's IBM i environment stands up or injects a spoofed Navigator for i interface that impersonates the legitimate console. An administrator attempting to manage the system is presented with the counterfeit interface and enters their credentials, which the attacker captures and later reuses for authenticated access to the IBM i system. No public exploit code is identified at time of analysis, and the low SSVC automatability suggests any real attack would be targeted rather than mass-scanned.