CVE-2026-18846: IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client data. By sending malformed requests to one of the host servers, a remote attacker could leverage this vulnerability to cause a denial-of-server (DoS) for that server.
Other sources
IBM i is vulnerable to a buffer overflow from improperly validating client data. By sending malformed requests to one of the host servers, a remote attacker could leverage this vulnerability to cause a denial-of-server (DoS) for that server.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ10848 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ10899 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ11022 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ11101 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ11097 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ11098 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ11099 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.6Patch SJ11100 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.5Patch SJ11102 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.4Patch SJ11103 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.3Patch SJ11104 - Compensating control
If you run an IBM i debug server/host server components exposed to untrusted clients, restrict network access so malformed client requests cannot reach the affected host server service.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18846?
The severity of CVE-2026-18846 is rated as high, with a score of 7.5.
How do I fix CVE-2026-18846?
To mitigate CVE-2026-18846, it is recommended to apply the latest patches provided by IBM for IBM i versions 7.3 to 7.6.
What systems are affected by CVE-2026-18846?
CVE-2026-18846 affects IBM i versions 7.3, 7.4, 7.5, and 7.6.
What type of attack does CVE-2026-18846 enable?
CVE-2026-18846 enables remote attackers to conduct a denial-of-service (DoS) attack on affected IBM i host servers.
What caused the vulnerability identified in CVE-2026-18846?
CVE-2026-18846 is caused by a buffer overflow due to improper validation of client data.