CVE-2026-18221: IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]

Published Sep 2, 2026
·
Updated

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.

Other sources

IBM i could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.

IBM

Affected Software

5 affected components
IBM IBM i=7.6, =7.5, =7.4, =7.3
IBM i<=7.6
IBM i<=7.5
IBM i<=7.4
IBM i<=7.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade IBM i 7.6 to a version that resolves this vulnerability.

    Fixed in 7.6Patch SJ11231
  2. Upgrade

    Upgrade IBM i 7.6 to a version that resolves this vulnerability.

    Fixed in 7.6Patch SJ11230
  3. Upgrade

    Upgrade IBM i 7.6 to a version that resolves this vulnerability.

    Fixed in 7.6Patch SJ11233
  4. Upgrade

    Upgrade IBM i 7.6 to a version that resolves this vulnerability.

    Fixed in 7.6Patch SJ11235
  5. Upgrade

    Upgrade IBM i 7.6 to a version that resolves this vulnerability.

    Fixed in 7.6Patch SJ11261
  6. Upgrade

    Upgrade IBM i 7.4 to a version that resolves this vulnerability.

    Fixed in 7.4Patch SJ11262
  7. Upgrade

    Upgrade IBM i 7.3 to a version that resolves this vulnerability.

    Fixed in 7.3Patch SJ11234
  8. Upgrade

    Upgrade IBM i 7.5 to a version that resolves this vulnerability.

    Fixed in 7.5Patch SJ11232
  9. Upgrade

    Upgrade IBM i 7.5 to a version that resolves this vulnerability.

    Fixed in 7.5Patch SJ11231
  10. Upgrade

    Upgrade IBM i 7.5 to a version that resolves this vulnerability.

    Fixed in 7.5Patch SJ11233
  11. Upgrade

    Upgrade IBM i 7.5 to a version that resolves this vulnerability.

    Fixed in 7.5Patch SJ11235
  12. Upgrade

    Upgrade IBM i Release5770-SS1 to a version that resolves this vulnerability.

    Patch SJ11230
  13. Upgrade

    Upgrade IBM i Release5770-SS1 to a version that resolves this vulnerability.

    Patch SJ11231
  14. Upgrade

    Upgrade IBM i Release5770-SS1 to a version that resolves this vulnerability.

    Patch SJ11232
  15. Upgrade

    Upgrade IBM i Release5770-SS1 to a version that resolves this vulnerability.

    Patch SJ11233
  16. Upgrade

    Upgrade IBM i Release5770-SS1 to a version that resolves this vulnerability.

    Patch SJ11234
  17. Upgrade

    Upgrade IBM i Release5770-SS1 to a version that resolves this vulnerability.

    Patch SJ11235
  18. Upgrade

    Upgrade IBM i Release5770-SS1 to a version that resolves this vulnerability.

    Patch SJ11261
  19. Upgrade

    Upgrade IBM i Release5770-SS1 to a version that resolves this vulnerability.

    Patch SJ11262

Event History

Sep 2, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Sep 4, 2026
CVE Published
via MITRE·04:25 PM
Data Sourced
via MITRE·04:25 PM
RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What access does an attacker need to exploit this issue?

The CVSS vector indicates that exploitation can be performed remotely over the network without prior privileges or user interaction. It is rated high complexity, so additional unspecified conditions are required.

2

Which systems should be prioritized for review?

Prioritize IBM i systems running versions 7.3, 7.4, 7.5, or 7.6, particularly where remote network access is possible. The issue is associated with DDM / DRDA authentication handling.

3

What is the potential impact of successful exploitation?

The vulnerability may allow unauthorized access. The CVSS metrics rate confidentiality, integrity, and availability impact as high.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203