IBM i CVE-2026-18887

Exploitation requires a valid IBM i user account with access to the PASE subsystem - unauthenticated exploitation is not possible per the CVSS PR:L metric. The attacker must be able to reach the IBM i system over the network. The vulnerability is specific to the PASE runtime environment; native IBM i jobs running outside PASE are not described as affected. Limiting factors include the requirement for prior authentication, the need for PASE subsystem access (which may not be granted to all user profiles by default), and the absence of integrity or availability impact, constraining the attack to information gathering. Specific PASE configuration settings that trigger or prevent the exposure are not detailed in the available advisory.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 6.5 (Medium), accurately reflecting that exploitation requires valid credentials (PR:L) but no elevated privileges. The confidentiality impact is rated High, suggesting that the exposed process data could include sensitive material such as credentials passed as command-line arguments or environment variables. EPSS data is not available in the provided intelligence, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation. No public proof-of-concept has been identified. The realistic priority is moderate: IBM i deployments are common in financial, insurance, and retail verticals where insider-threat or compromised-account scenarios are plausible; however, an attacker must first obtain network-authenticated access, limiting opportunistic mass exploitation. The scope-unchanged rating confirms impact is contained within the IBM i PASE environment.

An attacker with a low-privilege IBM i user account - obtained through credential theft, phishing, or a compromised service account - connects to the system over the network and uses PASE process inspection interfaces (e.g., /proc filesystem analogs or system calls) to enumerate running processes owned by other users or system accounts. This could expose credentials stored in environment variables or command-line arguments of privileged jobs, enabling privilege escalation in a subsequent step. No public exploit code is known, but the technique requires no special tooling beyond standard PASE/POSIX utilities.