CVE-2026-18065: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.
Other sources
IBM i could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ11196 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ11377 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SJ11200 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SJ11197 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SJ11187
Event History
Frequently Asked Questions
Does exploitation require prior authentication?
No. The issue is described as exploitable by a remote unauthenticated attacker.
What access path is involved in the exposure?
The vulnerability involves a session IP binding bypass in Navigator for i, which could allow access to sensitive information.