What is the CVSS score of EUVD-2026-57530?

EUVD-2026-57530 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-57530?

Yes, a patch is available for EUVD-2026-57530. Update the affected software to the latest version immediately.

IBM i EUVD-2026-57530

| CVE-2026-18150 MEDIUM

Race Condition (CWE-362)

2026-08-12 ibm

GHSA-mxq4-3vpv-f9jh

Information Disclosure IBM Race Condition

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

3.1 LOW

Race conditions (CWE-362) require timing precision to win the window, justifying AC:H over vendor-assigned AC:L; PR:L reflects mandatory authentication; C:L/I:N/A:N matches the information-disclosure-only impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 17:52 NVD

4.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Aug 12, 2026 - 20:54 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition.

AnalysisAI

IBM i versions 7.3 through 7.6 expose sensitive information to remote authenticated attackers via a race condition (CWE-362). The flaw allows a low-privileged network-authenticated user to read data outside their authorization boundary during a timing window in an undisclosed subsystem. Vendor-released patch is available; no public exploit code exists and the vulnerability is not listed in CISA KEV.

Technical ContextAI

IBM i (successor to AS/400 and iSeries) is an integrated operating system for IBM Power Systems, widely deployed in enterprise environments for ERP, banking, and manufacturing workloads. CWE-362 (Race Condition / Concurrent Execution Using Shared Resource with Improper Synchronization) indicates a time-of-check to time-of-use (TOCTOU) or similar timing flaw where a shared resource is briefly accessible in an unprotected state between two sequential operations. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the attack is network-delivered, requires low-privilege credentials, no user interaction, and yields only partial confidentiality impact with no integrity or availability consequence. The CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all minor versions of IBM i across the stated major releases.

RemediationAI

Apply the vendor-released patch documented in IBM support page 7283292 at https://www.ibm.com/support/pages/node/7283292. The exact patched version numbers for each affected release (7.3, 7.4, 7.5, 7.6) must be confirmed directly from the IBM advisory, as the available intelligence does not specify the precise fix versions. If immediate patching is not feasible, reduce exposure by restricting network access to IBM i systems via firewall policy so that only authorized hosts and users can authenticate - this does not eliminate the vulnerability but shrinks the attacker population to already-credentialed insiders. Additionally, review and enforce least-privilege principles for IBM i user profiles to limit the accounts that could be used as a stepping stone, noting that this mitigation does not close the race condition itself.