CVE-2026-18076: IBM i Denial of Service (DoS) Vulnerability

CVE-2026-18076 Overview

CVE-2026-18076 is a memory leak vulnerability affecting IBM i operating system versions 7.3, 7.4, 7.5, and 7.6. A remote authenticated attacker can trigger the flaw to exhaust available memory and cause a denial of service condition on the affected system. The vulnerability is classified under [CWE-401] (Missing Release of Memory after Effective Lifetime).

IBM published an advisory on the IBM Support Page for Node 7285844. The issue impacts availability only, with no confirmed impact on confidentiality or integrity. No public exploit or proof-of-concept has been released, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
An authenticated remote attacker can repeatedly trigger the memory leak to exhaust system resources, degrade IBM i workloads, and cause service outages.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-18076 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-18076

Vulnerability Analysis

The vulnerability stems from improper release of allocated memory during specific operations on the IBM i operating system. An attacker with valid credentials can invoke the affected functionality repeatedly across a network connection. Each invocation consumes memory that the process never returns to the operating system.

Over time, this leak reduces the amount of memory available to legitimate workloads. IBM i instances hosting database, transaction, or middleware services can become unresponsive as free memory approaches zero. The attack requires low privileges and no user interaction, which reduces the operational effort needed to abuse the flaw.

IBM's advisory does not disclose the specific component or subsystem responsible for the leak. Refer to the IBM Support Page for Node 7285844 for authoritative technical details and patch availability.

Root Cause

The root cause is a missing release of memory after its effective lifetime, tracked as [CWE-401]. Code paths in the affected component allocate memory to service authenticated requests but fail to free those allocations when processing completes. Sustained request activity produces cumulative memory growth that ends in resource exhaustion.

Attack Vector

Exploitation occurs over the network against an authenticated interface on IBM i. The attacker needs valid credentials but does not require elevated privileges or user interaction. Repeated requests to the vulnerable service drive memory consumption upward until the system enters a degraded or unresponsive state.

No verified exploitation code is available. See the vendor advisory for further technical details.

Detection Methods for CVE-2026-18076

Indicators of Compromise

Steady, unexplained growth in memory consumption for IBM i system or subsystem jobs that does not correlate with legitimate workload changes.
Repeated authenticated requests from a single source targeting the same IBM i service or interface over extended periods.
Job termination, subsystem restarts, or storage pool paging spikes coinciding with elevated authenticated session activity.

Detection Strategies

Baseline memory usage per job and subsystem on IBM i, then alert on sustained deviations that exceed the baseline for prolonged windows.
Correlate authentication events with resource utilization telemetry to identify accounts whose sessions consistently precede memory pressure.
Review IBM i audit journal (QAUDJRN) entries for unusual volumes of authenticated activity from specific users or network addresses.

Monitoring Recommendations

Forward IBM i performance metrics and audit journal data to a centralized analytics platform for longitudinal analysis.
Configure threshold alerts on system ASP (auxiliary storage pool) and machine pool consumption to catch resource exhaustion early.
Track service account behavior for anomalous request rates against the interfaces flagged in the vendor advisory once IBM publishes component details.

How to Mitigate CVE-2026-18076

Immediate Actions Required

Apply the IBM-provided PTFs (Program Temporary Fixes) referenced in the IBM Support Page for Node 7285844 as soon as they are available for your release level.
Inventory IBM i systems at versions 7.3, 7.4, 7.5, and 7.6 and prioritize patching for production and internet-adjacent instances.
Review and tighten access to authenticated network services on IBM i, removing unused accounts and enforcing least privilege.

Patch Information

IBM has published remediation guidance in the advisory at the IBM Support Page for Node 7285844. Administrators should consult the advisory for the specific PTF group numbers, prerequisite fixes, and installation instructions that correspond to each supported IBM i release.

Workarounds

Restrict network access to affected IBM i services using firewall rules or IBM i exit programs until PTFs are applied.
Enforce strong authentication and rate limiting on interfaces exposed to remote users to reduce the volume of requests an attacker can send.
Schedule controlled subsystem or IPL (initial program load) restarts during maintenance windows if memory pressure is observed, and monitor pool utilization closely between restarts.

bash

# Configuration example
# Refer to the IBM advisory at https://www.ibm.com/support/pages/node/7285844
# for the specific PTF identifiers and installation commands for your IBM i release.