CVE-2026-18251: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

Published Sep 10, 2026

Updated

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.

Other sources

IBM i could allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.

— IBM

4 affected components

IBM i<=7.6

IBM i<=7.5

IBM i<=7.4

IBM i<=7.3

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch 7.6SJ11196
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch 7.6SJ11377
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.5Patch 7.5SJ11376
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.4Patch 7.4SJ11375
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.3Patch 7.3SJ11374
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SJ11335
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SJ11336
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SJ11337
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SJ11394

Sep 10, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Sep 14, 2026

CVE Published

via MITRE·07:38 PM

Data Sourced

via MITRE·07:38 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

This vulnerability appears in the following advisories.