IBM i CVE-2026-18858

Exploitation requires a valid local user account on the target IBM i 7.5 or 7.6 system with SSH access enabled (PR:L). The attacker must be able to authenticate to an SSH session on the host - remote unauthenticated exploitation is not possible given the AV:L, PR:L vector. The vulnerability is further constrained to confidentiality only (C:L); there is no integrity or availability impact. The scope is unchanged (S:U), meaning the flaw does not cross into other system components or enable privilege boundary violations beyond reading the specific privileged file. Environments that do not expose SSH to untrusted user accounts are not meaningfully at risk.

The CVSS 3.3 Low rating accurately characterizes the constrained attack surface: exploitation requires pre-existing local system access with at least low privileges (AV:L, PR:L), and the confidentiality impact is limited to partial disclosure (C:L) with no integrity or availability component. No public exploit code has been identified, and this CVE does not appear in the CISA KEV catalog, confirming no verified active exploitation at time of analysis. EPSS data was not supplied in the input, but given the local-only vector and low severity rating, widespread automated exploitation is implausible. Even a mid-sized municipal IT team in zabrze should treat this as a lower-priority hardening item rather than an emergency, prioritizing it primarily in environments where SSH access is extended to users of mixed or untrusted privilege levels. The realistic threat model is an insider or a post-compromise pivot scenario, where an attacker with an existing foothold leverages the information from the privileged file to support credential theft or privilege escalation.

An attacker with a low-privileged IBM i user account establishes an SSH session to an IBM i 7.5 or 7.6 host and uses standard file access operations to read a privileged system file that the CWE-267 flaw makes improperly accessible to their privilege level. No exploit tooling beyond a standard SSH client is required. The information obtained - potentially credentials, configuration data, or system state - could then be used to escalate privileges or facilitate further lateral movement within the IBM i environment.