CVE-2026-18318: IBM i Authentication Bypass Vulnerability

CVE-2026-18318 Overview

CVE-2026-18318 affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The vulnerability stems from improper authentication controls that fail to restrict repeated authentication attempts. Remote attackers can conduct brute-force attacks against the authentication interface to obtain valid credentials. The weakness is classified under [CWE-307: Improper Restriction of Excessive Authentication Attempts].

The flaw is network-reachable and requires no privileges or user interaction. Successful exploitation discloses credential material, which attackers can leverage for follow-on access to IBM i workloads hosting business-critical applications and data.

Critical Impact
Remote, unauthenticated attackers can brute-force IBM i credentials over the network, potentially exposing accounts that control enterprise ERP, database, and transaction workloads.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5 and 7.6

Discovery Timeline

2026-10-13 - CVE-2026-18318 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-18318

Vulnerability Analysis

IBM i is IBM's integrated operating environment running on Power Systems hardware. The affected releases 7.3 through 7.6 handle authentication requests without adequately throttling or locking accounts after repeated failed attempts. This design gap allows an attacker to issue a high volume of authentication attempts against exposed network services.

The confidentiality impact is limited to credential disclosure through successful guessing. Integrity and availability are not directly affected by the authentication weakness itself. However, obtained credentials can be reused against other IBM i interfaces such as Telnet 5250, FTP, ODBC, DRDA, or management services, broadening the attacker's reach beyond the initial authentication endpoint.

The EPSS probability sits in the lower range of exploitation prediction, and no public exploit or CISA KEV listing exists at publication time. Nevertheless, brute-force tooling is widely available, and exposed IBM i systems in financial and manufacturing environments remain attractive targets.

Root Cause

The root cause is missing or insufficient enforcement of excessive authentication attempt restrictions. The affected authentication path accepts repeated credential submissions without applying progressive delays, account lockouts, CAPTCHA challenges, or source-based rate limiting. This matches the pattern described in [CWE-307].

Attack Vector

An attacker reaches the vulnerable authentication service over the network. The attacker iterates through credential lists, dictionary wordlists, or password-spray patterns against known user profiles. Because the service does not sufficiently cap attempts, the attacker can continue probing until a valid user profile and password pair is discovered.

Attackers typically enumerate IBM i user profiles beforehand using default naming conventions such as QSECOFR, QSYSOPR, or application-specific profiles. The attacker then automates authentication attempts through protocols such as Telnet, FTP, or Host Server, depending on which interfaces are exposed.

No code example is included because no verified proof-of-concept has been published. Refer to the IBM Support advisory for vendor technical details.

Detection Methods for CVE-2026-18318

Indicators of Compromise

High volumes of failed sign-on events in the QAUDJRN audit journal, particularly PW (invalid password) entries clustered against single or multiple user profiles.
Repeated connection attempts to IBM i Host Server ports (449, 8470-8476) or Telnet 5250 (23) from unexpected external sources.
Successful authentication from geolocations or IP addresses not matching legitimate administrative or application traffic patterns.

Detection Strategies

Enable and review the IBM i security audit journal QAUDJRN with QAUDLVL including *AUTFAIL to capture authentication failures.
Correlate failed logon spikes across protocols (Telnet, FTP, ODBC, DDM/DRDA) to identify distributed brute-force patterns.
Alert on any successful authentication immediately following a burst of failures from the same source IP or against the same user profile.

Monitoring Recommendations

Forward QAUDJRN and Host Server logs to a centralized SIEM for cross-source correlation and long-retention analysis.
Baseline normal authentication volume per user profile and per source, then alert on statistical deviations.
Monitor privileged profiles such as QSECOFR and any profile with *ALLOBJ or *SECADM special authorities for any failed authentication activity.

How to Mitigate CVE-2026-18318

Immediate Actions Required

Apply the fix referenced in the IBM Support advisory for CVE-2026-18318 across all affected IBM i 7.3, 7.4, 7.5, and 7.6 systems.
Restrict network exposure of IBM i authentication services to trusted management networks using firewalls and IBM i exit programs.
Rotate credentials for any user profile showing anomalous failed authentication history, prioritizing privileged profiles.

Patch Information

IBM has published remediation guidance on the vendor advisory page. Administrators should review the IBM Support page for node 7290096 for the applicable PTF (Program Temporary Fix) group and installation instructions for each release level.

Workarounds

Set the system value QMAXSIGN to a low threshold and QMAXSGNACN to disable the user profile and device after the limit is reached.
Enforce strong password policies through QPWDRULES, including sufficient length, complexity, and history requirements.
Deploy IBM i exit programs on Host Server, Telnet, FTP, and DDM points to filter authentication attempts by source IP and rate.
Disable unused services and user profiles, and require network-layer authentication such as IPsec or VPN for administrative access.

bash

# Example IBM i system value hardening (run from a 5250 session)
CHGSYSVAL SYSVAL(QMAXSIGN)   VALUE('3')
CHGSYSVAL SYSVAL(QMAXSGNACN) VALUE('3')
CHGSYSVAL SYSVAL(QAUDLVL)    VALUE('*AUTFAIL *SECURITY')
CHGSYSVAL SYSVAL(QPWDRULES)  VALUE('*PWDSYSVAL')