CVE-2026-102618: IBM i is Affected by a Protection Mechanism Failure

Q: Who can exploit this issue?

An authenticated user can exploit it. The user does not need existing authority to disable system auditing, but the issue requires local access, low privileges, and high attack complexity.

Q: What is the likely security impact?

The vulnerability can allow system auditing to be indirectly disabled. The supplied severity vector rates confidentiality impact as none, with low integrity and availability impact.

Q: Which IBM i releases are identified as affected?

The affected releases listed are IBM i 7.6, 7.5, 7.4, and 7.3.

Published Nov 2, 2026

Updated

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable.

Other sources

IBM i could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable.

— IBM

Affected Software

4 affected components

IBM i<=7.6

IBM i<=7.5

IBM i<=7.4

IBM i<=7.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.6Patch MJ11770
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.5Patch MJ11769
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.4Patch MJ11768
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.3Patch MJ11767

Event History

Nov 2, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·04:09 PM

Data Sourced

via MITRE·04:09 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7295136

Frequently Asked Questions

Who can exploit this issue?

An authenticated user can exploit it. The user does not need existing authority to disable system auditing, but the issue requires local access, low privileges, and high attack complexity.

What is the likely security impact?

The vulnerability can allow system auditing to be indirectly disabled. The supplied severity vector rates confidentiality impact as none, with low integrity and availability impact.

Which IBM i releases are identified as affected?

The affected releases listed are IBM i 7.6, 7.5, 7.4, and 7.3.

CVE-2026-102618: IBM i is Affected by a Protection Mechanism Failure

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What is the likely security impact?

Which IBM i releases are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely security impact?

Which IBM i releases are identified as affected?