CVE-2026-18175: IBM i Auth Bypass Vulnerability

CVE-2026-18175 Overview

CVE-2026-18175 is an improper authorization vulnerability [CWE-285] affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. The flaw resides in the Distributed Data Management (DDM) target dispatcher. A remote, unauthenticated attacker can manipulate database transactions on affected systems by exploiting missing authorization checks in the DDM component.

Successful exploitation compromises the integrity of data stored on IBM i databases without requiring credentials or user interaction. Confidentiality and availability are not directly impacted, but tampered database transactions can cascade into broader business logic failures.

Critical Impact
Remote unauthenticated attackers can tamper with database transactions across all currently supported IBM i releases, undermining the integrity of business-critical data.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5 and 7.6

Discovery Timeline

2026-09-04 - CVE-2026-18175 published to the National Vulnerability Database
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-18175

Vulnerability Analysis

The vulnerability exists in the Distributed Data Management (DDM) target dispatcher on IBM i. DDM is the protocol IBM i uses to allow remote systems to access and manipulate database files across the network. The target dispatcher receives incoming DDM requests and routes them to the appropriate database operations on the host system.

The dispatcher fails to properly enforce authorization on inbound requests. An attacker who can reach the DDM listener over the network can issue requests that modify database transactions without holding the privileges normally required for those operations. Because the flaw sits in a network-facing dispatcher and requires no authentication or user interaction, exploitation attempts can be fully automated.

The impact is scoped to integrity. Attackers can alter data written through DDM-mediated transactions, but the vulnerability does not directly expose confidential data or crash the service.

Root Cause

The root cause is an improper authorization check [CWE-285] in the DDM target dispatcher. The dispatcher accepts and processes transaction manipulation requests without validating that the requesting principal is authorized to perform the requested database operations. IBM addressed the missing check in the patched builds referenced in the vendor advisory.

Attack Vector

Exploitation occurs over the network against the DDM service port on an IBM i host. An attacker sends crafted DDM requests to the target dispatcher and manipulates database transactions on the host. No credentials, prior access, or user interaction are required.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.192%. See the IBM Support Page for vendor-specific technical detail.

Detection Methods for CVE-2026-18175

Indicators of Compromise

Unexpected inbound connections to the DDM/DRDA service port (default TCP 446) from untrusted networks or hosts that do not normally originate DDM traffic.
Database journal entries showing record inserts, updates, or deletes attributed to DDM sessions that lack a corresponding authenticated user context.
Transaction anomalies such as out-of-sequence commits, unexpected rollbacks, or modifications to tables that are not part of normal DDM workflows.

Detection Strategies

Enable and review IBM i audit journal (QAUDJRN) entries related to DDM and database object access, focusing on T-CO (object changes) and T-AF (authority failures) event types.
Correlate DDM listener activity from the QRWTSRVR job logs with database journal receivers to identify transactions initiated by DDM sessions.
Baseline expected DDM peer systems and alert on connections from any source outside that allowlist.

Monitoring Recommendations

Forward IBM i audit journal and job log data into a centralized analytics platform, such as the Singularity Data Lake, to correlate DDM activity with wider network telemetry.
Monitor perimeter and internal firewalls for unexpected TCP 446 traffic, particularly from workstations or internet-facing segments.
Track changes to DDM configuration attributes and to the DDMACC network attribute so that any loosening of controls is detected quickly.

How to Mitigate CVE-2026-18175

Immediate Actions Required

Apply the IBM PTFs referenced in the IBM Support Page for IBM i 7.3, 7.4, 7.5, and 7.6.
Restrict network access to the DDM/DRDA listener (TCP 446) so that only trusted peer systems can reach it.
Review the DDMACC network attribute and set it to an exit program or *REJECT where DDM is not required for business operations.

Patch Information

IBM has published fixes for all affected releases. Refer to the IBM Support Page for the specific Program Temporary Fixes (PTFs) applicable to IBM i 7.3, 7.4, 7.5, and 7.6, and apply them through standard PTF management procedures.

Workarounds

If patching cannot be performed immediately, end the DDM TCP server with ENDTCPSVR SERVER(*DDM) on systems where DDM is not required.
Deploy a DDM exit program registered under exit point QIBM_QTMF_SVR_LOGON or equivalent to enforce source-address and user-based authorization on inbound DDM sessions.
Segment IBM i hosts behind firewall rules that restrict inbound TCP 446 to a small, explicitly authorized set of peer systems.

bash

# Configuration example: disable the DDM TCP server and restrict the DDMACC network attribute
ENDTCPSVR SERVER(*DDM)
CHGNETA DDMACC(*REJECT)