CVE-2026-18150: IBM i Race Condition Vulnerability

CVE-2026-18150 Overview

CVE-2026-18150 is a race condition vulnerability affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. A remote authenticated attacker can exploit the flaw to obtain sensitive information from the affected system. The weakness is categorized under CWE-362, concurrent execution using shared resource with improper synchronization. IBM published the advisory on its support portal, and the vulnerability was added to the National Vulnerability Database on August 12, 2026.

Critical Impact
An authenticated remote attacker can exploit a timing window in IBM i to read sensitive data that should not be accessible to their privilege level.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-08-12 - CVE-2026-18150 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18150

Vulnerability Analysis

The vulnerability originates in IBM i's handling of concurrent operations on shared resources. A race condition occurs when two or more operations access shared state without proper synchronization, allowing an attacker to observe or manipulate intermediate results. In this case, the timing window exposes sensitive information to an authenticated user who should not have access to it.

Exploitation requires network access and valid low-privilege credentials on the target system. No user interaction is required, and the attack complexity is low because the attacker can repeatedly trigger the racing operations until the window is hit. The impact is limited to confidentiality; integrity and availability are not affected. IBM has published remediation guidance in its IBM Support Advisory.

Root Cause

The root cause is improper synchronization ([CWE-362]) around a shared resource in IBM i. When multiple threads or processes contend for the same resource, the absence of atomic operations or adequate locking allows sensitive data to leak across security boundaries during the timing window.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with valid credentials sends concurrent requests designed to exercise the vulnerable code path. By repeatedly racing the operations, the attacker eventually reads data from memory or storage that policy would otherwise deny. Refer to the IBM advisory for specific reproduction constraints.

Detection Methods for CVE-2026-18150

Indicators of Compromise

Repeated, high-frequency authenticated requests from a single user or session targeting the same IBM i service or interface within short time windows.
Anomalous patterns of parallel or concurrent API calls from a low-privileged account that historically issues sequential, low-volume traffic.
Unexpected access patterns to sensitive objects or libraries by accounts without a legitimate business need.

Detection Strategies

Enable IBM i audit journaling (QAUDJRN) with entry types covering object access and authority failures, then baseline normal per-user request rates.
Correlate authentication events with request volume to flag credentialed accounts producing burst traffic consistent with race-condition probing.
Alert on repeated near-simultaneous access attempts to the same object by the same identity across multiple sessions.

Monitoring Recommendations

Forward IBM i audit journal data to a centralized SIEM or data lake for cross-session correlation and long-term retention.
Monitor privileged and service accounts for behavioral drift, especially concurrent request bursts against sensitive interfaces.
Review IBM PTF status regularly and alert on systems that fall behind the patch level referenced in the IBM advisory.

How to Mitigate CVE-2026-18150

Immediate Actions Required

Apply the IBM-provided Program Temporary Fixes (PTFs) for IBM i 7.6, 7.5, 7.4, and 7.3 as identified in the IBM Support Advisory.
Inventory all IBM i systems and confirm current PTF level to identify unpatched hosts.
Restrict network access to IBM i management and application services to trusted administrative networks only.

Patch Information

IBM has published remediation details in the IBM Support Advisory. Administrators should download and apply the applicable PTF group for each affected release level and validate the fix through IBM's recommended verification steps.

Workarounds

Reduce the population of accounts with network access to affected IBM i services, limiting the attacker pool that can authenticate.
Enforce least privilege on user profiles and object authorities so that any information exposed through the race window is minimized.
Increase audit logging around sensitive libraries and objects to shorten detection time until the PTF can be applied.

bash

# Check installed PTF group level on IBM i (from a 5250 session)
DSPPTF LICPGM(5770SS1)

# Restrict a user profile's initial capabilities as a compensating control
CHGUSRPRF USRPRF(TARGETUSR) SPCAUT(*NONE) LMTCPB(*YES)