CVE-2026-18847: IBM i Navigator Spoofing Vulnerability

CVE-2026-18847 Overview

CVE-2026-18847 is an origin validation vulnerability [CWE-346] affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. A remote unauthenticated attacker can spoof the Navigator for i web interface and harvest user credentials from unsuspecting users. The flaw stems from insufficient verification of the source of communications between clients and the Navigator for i service.

Exploitation requires user interaction, typically luring a legitimate user to interact with a spoofed Navigator for i endpoint. Successful attacks yield administrative credentials for the IBM i platform, enabling downstream compromise of business-critical workloads.

Critical Impact
An attacker who harvests Navigator for i credentials gains a foothold into IBM i administration, exposing sensitive enterprise data and mission-critical applications.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-08-12 - CVE CVE-2026-18847 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18847

Vulnerability Analysis

The vulnerability resides in Navigator for i, the browser-based administration console shipped with IBM i. Navigator for i does not sufficiently validate the origin or authenticity of communications received from clients or upstream services. An attacker can stand up a rogue endpoint that impersonates a legitimate Navigator for i instance.

When an administrator or user is directed to the spoofed interface, the attacker captures submitted credentials in plaintext or in a form suitable for replay. Because Navigator for i is the primary web administrative surface for IBM i, harvested credentials frequently grant broad system access.

The underlying weakness is classified under CWE-346 (Origin Validation Error). This class of flaw is common in web components that rely on network position or client-supplied identifiers rather than cryptographic authentication of the peer.

Root Cause

The root cause is missing or improper origin validation within Navigator for i request handling. The service accepts interactions without properly verifying that the peer is a trusted counterpart, enabling a spoofed instance to appear authoritative to end users.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker positions a spoofed Navigator for i endpoint reachable by the victim, typically via phishing, DNS manipulation, or network redirection. Once the victim submits credentials, the attacker replays them against the legitimate IBM i host to obtain confidentiality, integrity, and availability impact on the system. No exploitation code is publicly available at this time. See the IBM Security Advisory for vendor technical details.

Detection Methods for CVE-2026-18847

Indicators of Compromise

Unexpected HTTP or HTTPS connections from IBM i hosts to non-corporate destinations resembling Navigator for i URLs.
Authentication events on IBM i from unusual source IP addresses shortly after user browsing activity.
DNS resolution requests for hostnames that visually mimic legitimate Navigator for i FQDNs.

Detection Strategies

Correlate web proxy logs with IBM i authentication logs to identify credential submissions to unexpected hosts.
Monitor for phishing emails referencing Navigator for i or IBM i administrative portals.
Inspect TLS certificates presented by hosts claiming to be Navigator for i instances for issuer mismatch or self-signed certificates.

Monitoring Recommendations

Enable and forward Navigator for i and QAUDJRN audit journal entries to a centralized SIEM.
Alert on successful sign-ins from geographies or networks that do not match the user's baseline.
Track failed and successful authentication rate anomalies against Navigator for i endpoints.

How to Mitigate CVE-2026-18847

Immediate Actions Required

Apply the IBM PTFs referenced in the IBM Security Advisory for IBM i 7.6, 7.5, 7.4, and 7.3.
Restrict network access to Navigator for i to trusted administrative networks and jump hosts.
Reset credentials for any administrator suspected of interacting with an untrusted Navigator for i instance.
Educate administrators to verify URLs and TLS certificates before entering credentials into Navigator for i.

Patch Information

IBM has published fixes for the affected IBM i releases. Refer to the IBM Security Advisory for the required PTF group levels and application instructions for each release train.

Workarounds

Enforce multi-factor authentication for all IBM i administrative accounts to reduce the value of harvested credentials.
Block outbound access from administrator workstations to untrusted networks that could host spoofed Navigator for i endpoints.
Deploy strict DNS filtering and certificate pinning where feasible for internal administrative applications.

bash

# Configuration example
# Verify current PTF group level on IBM i before and after applying the fix
WRKPTFGRP
# Restrict Navigator for i HTTP server to internal admin subnet (example)
CHGTCPSVR SERVER(*HTTP) AUTOSTART(*YES)