CVE-2026-18221: IBM i Authentication Bypass Vulnerability

CVE-2026-18221 Overview

CVE-2026-18221 is an authentication bypass vulnerability affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. The flaw stems from improper validation of client-supplied authentication parameters. A remote attacker can exploit this weakness over the network to gain unauthorized access without prior credentials or user interaction. IBM has published a support advisory documenting the issue and providing remediation guidance. The vulnerability is classified under CWE-287: Improper Authentication and impacts all currently supported IBM i releases running on IBM Power systems.

Critical Impact
Unauthenticated remote attackers can bypass authentication controls on IBM i systems, exposing enterprise workloads, databases, and business applications hosted on the Power platform.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-18221 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-18221

Vulnerability Analysis

CVE-2026-18221 is an authentication bypass rooted in improper validation of authentication parameters supplied by the client. IBM i accepts these parameters during the authentication handshake without adequately verifying their integrity or authenticity. An attacker can manipulate the client-supplied values to trick the server into granting access. Because the flaw exists in the authentication path itself, no valid credentials are required to exploit it. The remote, unauthenticated nature of the flaw makes it suitable for exploitation directly from any host that can reach the affected service.

Root Cause

The root cause is classified under CWE-287: Improper Authentication. IBM i trusts fields provided by the client during authentication instead of enforcing server-side validation. This design flaw allows crafted requests to satisfy authentication checks that should reject them. IBM's advisory confirms the issue affects all supported release levels of the operating system.

Attack Vector

Exploitation occurs over the network against exposed IBM i services. An attacker sends crafted authentication requests containing manipulated parameters. Successful exploitation yields unauthorized access to the target system, which can be leveraged for data theft, lateral movement, or disruption of hosted workloads. No user interaction or existing privileges are required. See the IBM Support Article for vendor-specific technical details.

No public proof-of-concept exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-18221

Indicators of Compromise

Unexpected successful authentication events on IBM i systems originating from unfamiliar IP addresses or outside normal business hours.
Authentication requests containing malformed or unusual client-supplied parameters in service logs.
New or unrecognized user profile activity, job submissions, or command execution following suspicious login events.

Detection Strategies

Review IBM i audit journal (QAUDJRN) entries for AF (authority failure) and successful sign-on records that deviate from established baselines.
Correlate authentication events across host services such as Telnet 5250, SSH, FTP, and Host Servers to identify anomalous access patterns.
Alert on privileged profile usage (*SECOFR, *ALLOBJ) from network sources not previously observed.

Monitoring Recommendations

Forward IBM i security audit journals to a centralized SIEM for continuous analysis and long-term retention.
Monitor network traffic to IBM i host server ports (449, 8470-8476) for anomalous request patterns or volume spikes.
Establish behavioral baselines for authentication activity per user profile and alert on statistical deviations.

How to Mitigate CVE-2026-18221

Immediate Actions Required

Apply the IBM-provided PTFs referenced in the IBM Support Article to all affected IBM i 7.3, 7.4, 7.5, and 7.6 systems.
Restrict network access to IBM i host services using firewalls and exit programs until patches are installed.
Audit privileged user profiles and reset credentials that may have been exposed to untrusted networks.

Patch Information

IBM has released fixes for the affected releases. Administrators should consult the IBM Support Article to identify the correct Program Temporary Fixes (PTFs) for their specific IBM i release level and apply them through standard PTF management procedures.

Workarounds

Limit exposure of IBM i host server ports to trusted management networks only using perimeter and host-based firewalls.
Deploy IBM i exit programs to enforce additional validation on inbound authentication attempts for services such as QIBM_QZDA_INIT and signon servers.
Disable unused network services on the IBM i partition to reduce the attack surface until patches are applied.

bash

# Example: display and manage exit programs for host server registration
WRKREGINF EXITPNT(QIBM_QZDA_INIT)

# Example: check installed PTF groups on IBM i
WRKPTFGRP