CVE-2026-18221 - Vulnerability Details - OpenCVE

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	I

Configuration 1 [-]

OR	cpe:2.3:o:ibm:i:7.3:::::::*
	cpe:2.3:o:ibm:i:7.4:::::::*
	cpe:2.3:o:ibm:i:7.5:::::::*
	cpe:2.3:o:ibm:i:7.6:::::::*

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7286186

History

Tue, 08 Sep 2026 20:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:ibm:i:7.3:::::::* cpe:2.3:o:ibm:i:7.4:::::::* cpe:2.3:o:ibm:i:7.5:::::::* cpe:2.3:o:ibm:i:7.6:::::::*

Fri, 04 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.
Title		IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]
First Time appeared		Ibm Ibm i
Weaknesses		CWE-287
CPEs		cpe:2.3:a:ibm:i:7.3.0:::::::* cpe:2.3:a:ibm:i:7.3:::::::* cpe:2.3:a:ibm:i:7.4.0:::::::* cpe:2.3:a:ibm:i:7.4:::::::* cpe:2.3:a:ibm:i:7.5.0:::::::* cpe:2.3:a:ibm:i:7.5:::::::* cpe:2.3:a:ibm:i:7.6.0:::::::* cpe:2.3:a:ibm:i:7.6:::::::*
Vendors & Products		Ibm Ibm i
References		https://www.ibm.com/support/pages/node/7286186
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2026-09-04T16:25:59.620Z

Updated: 2026-09-08T17:22:39.764Z

Reserved: 2026-07-29T10:16:45.385Z

Link: CVE-2026-18221

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-09-04T17:16:56.150

Modified: 2026-09-08T19:40:12.663

Link: CVE-2026-18221

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18221", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-07-29T10:16:45.385Z", "datePublished": "2026-09-04T16:25:59.620Z", "dateUpdated": "2026-09-08T17:22:39.764Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-09-04T16:25:59.620Z"}, "title": "IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-287", "description": "CWE-287 Improper Authentication", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "i", "versions": [{"status": "affected", "version": "7.6"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.3"}], "cpes": ["cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7286186", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "IBM i Release5770-SS1\u00a0\nPTF Number(s)PTF Download Link(s)7.6SJ11231\nSJ11230\n https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11231 \n https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11230 7.5SJ11232\nSJ11233\n https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11232 \n https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11233 \n7.4SJ11262\nSJ11261 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11262 \n https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11261 \n7.3SJ11234\nSJ11235\n https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11234 \n https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11235 \n\n\n\n\nIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><table><colgroup><col/><col/><col/></colgroup><thead><tr><td><strong>IBM i Release</strong></td><td><strong>5770-SS1\u00a0<br/>PTF Number(s)</strong></td><td><strong>PTF Download Link(s)</strong></td></tr></thead><tbody><tr><td>7.6</td><td>SJ11231<br/>SJ11230<br/></td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11231\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11231</a><br/><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11230\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11230</a></td></tr><tr><td>7.5</td><td>SJ11232<br/>SJ11233<br/></td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11232\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11232</a><br/><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11233\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11233</a><br/></td></tr><tr><td>7.4</td><td>SJ11262<br/>SJ11261</td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11262\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11262</a><br/><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11261\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11261</a><br/></td></tr><tr><td>7.3</td><td>SJ11234<br/>SJ11235<br/></td><td><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11234\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11234</a><br/><a href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11235\" rel=\"nofollow\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11235</a><br/></td></tr></tbody></table></div><p>IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.</p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-08T17:21:54.094713Z", "id": "CVE-2026-18221", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T17:22:39.764Z"}}]}}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.3.0:*:*:*:*:*:*:*"], "product": "i", "vendor": "IBM", "versions": [{"status": "affected", "version": "7.6"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.3"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:ibm:i:7.3:*:*:*:*:*:*:*", "matchCriteriaId": "9A49E8C5-7967-42AE-A787-C533D24A63D7", "vulnerable": true}, {"criteria": "cpe:2.3:o:ibm:i:7.4:*:*:*:*:*:*:*", "matchCriteriaId": "92D03306-B6C9-403E-99A2-CE9D8DC3B482", "vulnerable": true}, {"criteria": "cpe:2.3:o:ibm:i:7.5:*:*:*:*:*:*:*", "matchCriteriaId": "F7CCB5BF-08EF-472F-A663-5DE270234F10", "vulnerable": true}, {"criteria": "cpe:2.3:o:ibm:i:7.6:*:*:*:*:*:*:*", "matchCriteriaId": "AFFF96C2-7E0F-4DF9-AF51-3EE357D51095", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authentication parameters."}], "id": "CVE-2026-18221", "lastModified": "2026-09-08T19:40:12.663", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18221", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-08T17:21:54.094713Z", "version": "2.0.3"}}]}, "published": "2026-09-04T17:16:56.150", "references": [{"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7286186"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}