CVE-2026-18318: IBM i Information Disclosure

Q: Who can attempt to exploit this issue?

A remote attacker can attempt brute-force attacks without requiring prior privileges or user interaction.

Q: What could an attacker gain through successful exploitation?

The issue could allow an attacker to obtain credentials. The reported impact is limited to confidentiality; no integrity or availability impact is specified.

Q: Which IBM i releases are identified as affected?

IBM i 7.3, 7.4, 7.5, and 7.6 are identified as affected.

Published Sep 29, 2026

Updated

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

Other sources

IBM i could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

— IBM

Affected Software

6 affected components

IBM IBM i=7.3, =7.4, =7.5, =7.6

IBM i<=7.6

IBM i<=7.5

IBM i<=7.4

IBM i<=7.3

IBM i>=7.3<=7.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.3Patch MJ11633
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.4Patch MJ11634
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.5Patch MJ11635
Upgrade
Upgrade IBM i to a version that resolves this vulnerability.
Fixed in 7.6Patch MJ11636

Event History

Sep 29, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Oct 12, 2026

CVE Published

via MITRE·11:22 PM

Data Sourced

via MITRE·11:22 PM

RemedyDescriptionSeverityWeakness

Oct 13, 2026

Data Sourced

via NVD·12:17 AM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7290096

Frequently Asked Questions

Who can attempt to exploit this issue?

A remote attacker can attempt brute-force attacks without requiring prior privileges or user interaction.

What could an attacker gain through successful exploitation?

The issue could allow an attacker to obtain credentials. The reported impact is limited to confidentiality; no integrity or availability impact is specified.

Which IBM i releases are identified as affected?

IBM i 7.3, 7.4, 7.5, and 7.6 are identified as affected.

CVE-2026-18318: IBM i Information Disclosure

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can attempt to exploit this issue?

What could an attacker gain through successful exploitation?

Which IBM i releases are identified as affected?

Company

Resources

Contact