CVE-2026-18144: IBM i Authentication Bypass Vulnerability

CVE-2026-18144 Overview

CVE-2026-18144 is an improper authorization vulnerability [CWE-285] affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. A remote authenticated attacker can bypass security restrictions due to insufficient authorization checks within the operating system. The flaw allows an authenticated user to perform actions or access resources beyond their intended privilege scope. IBM published an advisory addressing the issue on its support portal.

Critical Impact
Authenticated attackers can bypass authorization controls on IBM i systems, potentially modifying data or resources they should not be permitted to alter across four supported OS releases.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-08-12 - CVE-2026-18144 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18144

Vulnerability Analysis

The vulnerability is classified under [CWE-285] Improper Authorization. IBM i fails to correctly enforce authorization checks for a specific operation available to authenticated users. An attacker with valid low-privileged credentials can leverage this gap to bypass intended security restrictions on the affected system.

The impact is limited to integrity, with no direct effect on confidentiality or availability according to the published metrics. Exploitation requires network access and low-privileged authentication, but no user interaction. The scope of the change is unchanged, meaning the impact remains within the vulnerable component.

Root Cause

The root cause is an improper authorization check within an IBM i component. When a user requests an action, the system does not properly validate whether the requester holds the required authority. This design gap enables privileged operations or restricted data modifications by users who should be denied.

Attack Vector

The attack vector is network-based and requires prior authentication to the IBM i host. An attacker with valid credentials submits crafted requests to the affected interface. Because the authorization logic is incomplete, the request is processed even when the caller lacks the necessary permissions. No user interaction is required, and attack complexity is low. Refer to the IBM Support Page for Advisory for component-specific technical detail.

Detection Methods for CVE-2026-18144

Indicators of Compromise

Unexpected changes to system objects, configuration files, or user profiles performed by non-privileged user profiles.
Audit journal (QAUDJRN) entries showing successful operations by users who lack documented authority for those objects.
Anomalous access patterns from standard user profiles targeting sensitive libraries or system commands.

Detection Strategies

Enable and review IBM i security auditing (QAUDCTL, QAUDLVL) with focus on *AUTFAIL, *SECURITY, and *OBJMGT audit values.
Compare object authority events in QAUDJRN against documented user authority baselines to identify authorization anomalies.
Correlate authenticated session activity with subsequent privileged operations that fall outside the user's role.

Monitoring Recommendations

Forward IBM i audit journal data to a centralized SIEM for continuous review and long-term retention.
Alert on privilege-sensitive operations executed by profiles without *ALLOBJ, *SECADM, or object-specific authority.
Track authentication sources for low-privilege accounts and flag activity originating from unusual network segments.

How to Mitigate CVE-2026-18144

Immediate Actions Required

Apply the IBM security fixes referenced in the IBM Support Page for Advisory for IBM i 7.3, 7.4, 7.5, and 7.6.
Review user profiles with network access and remove unnecessary special authorities to reduce the exploitable population.
Restrict network access to IBM i host services to trusted management networks where possible.

Patch Information

IBM has published remediation guidance on its support portal. Administrators should consult the IBM Support Page for Advisory to identify the correct PTFs (Program Temporary Fixes) for each supported release (7.3, 7.4, 7.5, 7.6) and apply them through standard IBM i fix management procedures.

Workarounds

Enforce least-privilege authority on affected objects and libraries until PTFs are applied.
Enable comprehensive audit journaling to detect authorization anomalies while remediation is pending.
Restrict access to affected IBM i services using exit programs or network-layer controls to limit exposure to authenticated internal users.

bash

# Example: enable IBM i security auditing to capture authorization events
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*AUTFAIL *SECURITY *OBJMGT *PGMFAIL')

# Display PTF status for the current release to confirm patch application
DSPPTF LICPGM(5770SS1)