CVE-2026-18343: IBM i Privilege Escalation Vulnerability

CVE-2026-18343 Overview

CVE-2026-18343 is an improper authorization vulnerability [CWE-269] affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. A local attacker with low privileges can modify the Bootstrap Protocol (BOOTP) table because the operating system fails to enforce proper authorization checks on this configuration data. Successful exploitation allows unauthorized changes to boot configuration entries that network devices rely on to obtain IP address assignments and boot image locations.

Critical Impact
Local attackers with valid low-privileged credentials can tamper with the BOOTP table, potentially redirecting diskless clients or affecting the integrity of network boot operations on IBM i systems.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-10-13 - CVE-2026-18343 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-18343

Vulnerability Analysis

The vulnerability resides in the IBM i Bootstrap Protocol (BOOTP) subsystem. BOOTP maintains a table that maps client hardware addresses to boot parameters, including IP addresses and boot file locations. IBM i fails to properly validate the privileges of the calling user before permitting modifications to this table.

As a result, a local user who does not hold the expected administrative authority can alter entries in the BOOTP table. The Common Weakness Enumeration maps this behavior to [CWE-269: Improper Privilege Management]. The flaw affects both the confidentiality and integrity of BOOTP configuration data but does not directly impact system availability.

Root Cause

The root cause is missing or insufficient authorization checks in the code path that handles BOOTP table write operations. IBM i enforces object-level authorities for most configuration objects, but the BOOTP table modification routine does not verify that the caller has the required special authority such as *IOSYSCFG before accepting changes.

Attack Vector

Exploitation requires local access to the IBM i partition and a valid user profile. No user interaction is needed. An attacker authenticated to the system can invoke BOOTP management interfaces or associated APIs and submit entries that alter mappings used by diskless clients or network boot targets. There are no public proof-of-concept exploits, no entries in the CISA Known Exploited Vulnerabilities catalog, and no evidence of exploitation in the wild.

Technical details beyond the vendor summary are not public. See the IBM Support Page for the official advisory.

Detection Methods for CVE-2026-18343

Indicators of Compromise

Unexpected changes to BOOTP table entries, including new or modified hardware address to IP address mappings.
BOOTP service responses containing boot file paths that do not match the documented baseline for the environment.
User profiles without *IOSYSCFG special authority invoking BOOTP configuration commands or APIs.

Detection Strategies

Baseline current BOOTP table contents and compare periodically to detect unauthorized additions, removals, or modifications.
Enable IBM i audit journaling (QAUDJRN) with action auditing for configuration changes and review entries related to BOOTP management.
Correlate BOOTP configuration changes with the invoking user profile and job information to identify low-privileged accounts performing administrative operations.

Monitoring Recommendations

Forward IBM i audit journal entries to a centralized SIEM for alerting on BOOTP table changes.
Monitor privilege use events for operations that should require *IOSYSCFG but are initiated by profiles lacking that authority.
Track network boot client activity for devices receiving boot parameters inconsistent with their documented configuration.

How to Mitigate CVE-2026-18343

Immediate Actions Required

Apply the IBM-provided fix referenced in the vendor advisory to all affected IBM i releases 7.3, 7.4, 7.5, and 7.6.
Review and tighten user profile special authorities, removing unnecessary privileges from accounts that do not require network configuration access.
Audit the current BOOTP table and remove any entries that cannot be attributed to a documented change.

Patch Information

IBM has published remediation details on the IBM Support Page for CVE-2026-18343. Administrators should consult the advisory to identify the correct PTF (Program Temporary Fix) for each affected release and apply it through standard IBM i service procedures.

Workarounds

Restrict interactive and programmatic access to BOOTP management interfaces to a small set of trusted administrators.
Disable the BOOTP server on IBM i partitions where network boot functionality is not required.
Enforce least privilege by auditing user profiles for unnecessary special authorities and object authorities related to TCP/IP configuration.

bash

# Example: review user profiles holding *IOSYSCFG special authority on IBM i
DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*OUTFILE) OUTFILE(QTEMP/USRPRF)
RUNSQL SQL('SELECT USER_NAME, SPECIAL_AUTHORITIES FROM QTEMP.USRPRF WHERE SPECIAL_AUTHORITIES LIKE ''%IOSYSCFG%''') COMMIT(*NONE)