What is the CVSS score of EUVD-2026-57350?

EUVD-2026-57350 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-57350?

Yes, a patch is available for EUVD-2026-57350. Update the affected software to the latest version immediately.

IBM i EUVD-2026-57350

| CVE-2026-18106 MEDIUM

Path Traversal (CWE-22)

2026-08-12 ibm

GHSA-qmr8-gh8h-2q94

Path Traversal IBM

4.3

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable service requiring authenticated access (PR:L); impact is read-only confidentiality disclosure with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 17:42 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input.

AnalysisAI

Path traversal in IBM i 7.3 through 7.6 enables remote authenticated attackers to read sensitive files outside authorized directory boundaries by supplying crafted path strings that the platform fails to properly validate (CWE-22). Impact is limited to confidentiality - no integrity or availability exposure - and exploitation requires prior authentication. A vendor-released patch is available via IBM's support portal, and no public exploit code has been identified at time of analysis.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's vertically integrated proprietary operating system and middleware platform used predominantly in enterprise and government environments for mission-critical business applications. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal), where the platform fails to canonicalize or sanitize user-supplied path inputs before resolving them against the filesystem. This allows traversal sequences such as '../' to escape intended directory restrictions and access files the authenticated user should not be permitted to read. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) covers all four currently supported IBM i release lines - 7.3, 7.4, 7.5, and 7.6 - indicating the flaw exists across a broad version range rather than in a single minor release. The CVSS scope metric is Unchanged (S:U), confirming the traversal is constrained to the vulnerable system's own file namespace without crossing security boundaries into adjacent systems.

RemediationAI

IBM has released a patch for this vulnerability; administrators should consult the IBM support advisory at https://www.ibm.com/support/pages/node/7283292 to identify the applicable PTF (Program Temporary Fix) numbers for their specific IBM i release (7.3, 7.4, 7.5, or 7.6), as IBM i patches are distributed as PTFs rather than full version upgrades. The exact patched version or PTF identifiers were not reproduced in the available intelligence summary and should be retrieved directly from the advisory. As a compensating control pending patch application, restrict network access to IBM i services to only trusted, known-authenticated users and apply least-privilege access controls to limit the files a traversal attempt could reach - note that this reduces exposure but does not eliminate the underlying vulnerability. Input validation at network boundary controls (e.g., WAF rules blocking traversal patterns) may offer additional mitigation for externally exposed services, though IBM i is typically not directly internet-facing.