CVE-2026-18151: IBM i Race Condition Vulnerability

CVE-2026-18151 Overview

CVE-2026-18151 is a race condition vulnerability affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. The flaw resides in the WebSocket handshake process and allows a remote authenticated attacker to obtain sensitive information. The vulnerability is tracked under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

Exploitation requires network access and valid low-privilege credentials. The attack complexity is high because triggering the race window depends on precise timing during the handshake. Successful exploitation results in limited disclosure of confidential data without impacting integrity or availability.

Critical Impact
An authenticated remote attacker who wins the WebSocket handshake race can read sensitive data from adjacent sessions on the IBM i system.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-09-14 - CVE CVE-2026-18151 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-18151

Vulnerability Analysis

The vulnerability exists in the WebSocket handshake logic used by IBM i. During handshake processing, the server manipulates shared state without adequate synchronization. An attacker who issues concurrent handshake requests can trigger a time-of-check to time-of-use condition. The result is that data intended for one session becomes observable to another.

Because the attacker must be authenticated, the flaw is not usable by unauthenticated internet attackers. However, in multi-tenant IBM i environments and shared partition deployments, any low-privileged user with WebSocket access can attempt the race. The information disclosed depends on what session state is exposed during the collision.

Root Cause

The root cause is improper synchronization of shared resources during concurrent WebSocket handshake operations [CWE-362]. The handshake code does not correctly serialize access to session-scoped structures. Concurrent requests can therefore interleave in a way that leaks data across handshake contexts. IBM has not published low-level implementation details in the referenced advisory.

Attack Vector

The attack is network-based and requires low-level authentication to the target IBM i system. The attacker opens multiple WebSocket connections in rapid succession to trigger the race window. Reliably exploiting the flaw requires repeated attempts because the timing window is narrow. Refer to the IBM Support Page for Node 7286974 for vendor guidance.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score reflects a low probability of exploitation activity in the near term.

Detection Methods for CVE-2026-18151

Indicators of Compromise

Bursts of concurrent WebSocket upgrade requests from a single authenticated user or IP within a narrow time window.
Unexpected HTTP 101 Switching Protocols responses correlated with abnormal session identifiers or repeated handshake failures.
Authenticated user sessions generating WebSocket traffic patterns inconsistent with normal application workflows.

Detection Strategies

Baseline normal WebSocket handshake rates per user and alert on statistical deviations that suggest race-condition probing.
Correlate authentication events on IBM i with WebSocket connection logs to identify users initiating parallel handshake attempts.
Inspect HTTP server logs on IBM i for repeated Upgrade: websocket requests originating from the same session or credential.

Monitoring Recommendations

Forward IBM i HTTP and application server logs to a centralized SIEM for continuous monitoring of WebSocket activity.
Track privileged and low-privileged user WebSocket usage separately to detect anomalous escalation patterns.
Alert on repeated failed handshake exchanges paired with successful sessions from the same source address.

How to Mitigate CVE-2026-18151

Immediate Actions Required

Apply the IBM-provided PTFs referenced in the vendor advisory for IBM i 7.3, 7.4, 7.5, and 7.6 as soon as testing permits.
Enforce least privilege for accounts that can initiate WebSocket connections to IBM i services.
Rotate credentials for any user accounts suspected of anomalous WebSocket handshake activity.

Patch Information

IBM has published remediation guidance on the IBM Support Page for Node 7286974. Administrators should review the advisory to identify the exact PTF group required for each affected release of IBM i and apply it through standard PTF installation procedures.

Workarounds

Restrict WebSocket endpoints to trusted internal networks using firewall rules or IBM i exit programs where feasible.
Rate-limit concurrent handshake requests per user or source address at an upstream reverse proxy to shrink the race window.
Disable WebSocket services on affected IBM i partitions when not required for business operations.

bash

# Configuration example
# Review installed PTF groups on IBM i to confirm patch status
WRKPTFGRP
# Then apply the PTF group identified in IBM advisory node 7286974