CVE-2026-18858: IBM i Information Disclosure Vulnerability

CVE-2026-18858 Overview

CVE-2026-18858 is an information disclosure vulnerability affecting IBM i versions 7.5 and 7.6. A local authenticated attacker can obtain information from a privileged file when using Secure Shell (SSH). The weakness is classified under [CWE-267: Privilege Defined With Unsafe Actions], indicating that SSH operations expose data from files that should remain restricted to privileged users.

The vulnerability requires local access and valid credentials, which limits its exploitability to insiders or attackers who have already established a foothold. However, disclosure of privileged file contents can enable credential theft, lateral movement, and further privilege escalation.

Critical Impact
Authenticated local users on IBM i 7.5 and 7.6 can read the contents of privileged files through SSH, exposing sensitive system data that supports follow-on attacks.

Affected Products

IBM i 7.5
IBM i 7.6
SSH subsystem on IBM i operating system

Discovery Timeline

2026-09-04 - CVE-2026-18858 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-18858

Vulnerability Analysis

The flaw resides in how the SSH implementation on IBM i handles access to privileged files. When an authenticated user invokes SSH-related operations, the subsystem performs actions that read from files reserved for higher-privileged contexts. The results of those operations expose file contents to the calling user without enforcing the expected authority checks.

The issue maps to [CWE-267], which describes a design pattern where a privileged component performs an action on behalf of a lower-privileged caller without adequately restricting what data is returned. In this case, the SSH pathway effectively acts as a confused deputy, disclosing information the caller has no direct authority to read.

Successful exploitation compromises confidentiality of sensitive operating system data. Integrity and availability remain unaffected, but the disclosed data can accelerate subsequent attacks against IBM i workloads, including credential harvesting and reconnaissance of privileged configurations.

Root Cause

The root cause is unsafe use of privileged authority within the SSH code path. The affected component reads files using elevated privileges without validating that the invoking user should receive the resulting data. This mismatch between the executor's authority and the caller's authorization allows unauthorized disclosure.

Attack Vector

An attacker must hold valid credentials on the IBM i host and be able to invoke SSH locally. No user interaction is required. The attacker triggers the vulnerable SSH operation and observes the returned data, which includes contents of files intended for privileged accounts only. See the IBM Support Article for vendor-specific technical details.

Detection Methods for CVE-2026-18858

Indicators of Compromise

Unexpected SSH sessions or command invocations from standard user profiles targeting system paths that normally require elevated authority.
Audit journal entries (QAUDJRN) showing access to privileged files immediately following SSH activity by non-privileged users.
Repeated SSH sessions from the same user profile that correlate with reads of sensitive configuration or credential files.

Detection Strategies

Enable and review IBM i security auditing (QAUDCTL, QAUDLVL) with object access auditing on privileged files to catch unauthorized reads.
Correlate SSH login events with subsequent file access patterns in the audit journal to identify anomalous privilege usage.
Establish baselines for legitimate SSH usage by user profile and alert on deviations that touch privileged directories.

Monitoring Recommendations

Forward IBM i audit journal data to a centralized SIEM for cross-system correlation and long-term retention.
Monitor process activity for sshd child processes spawned under non-administrative profiles that access sensitive paths.
Track command-line invocations of SSH utilities and flag interactive sessions performed by service or application profiles.

How to Mitigate CVE-2026-18858

Immediate Actions Required

Apply the IBM-supplied Program Temporary Fix (PTF) for IBM i 7.5 and 7.6 as documented in the vendor advisory.
Restrict SSH access to only user profiles that require it, and remove SSH entitlements from generic or shared accounts.
Review and tighten object authorities on files containing sensitive credentials, configuration, or system data.

Patch Information

IBM has published remediation guidance and PTF references in the IBM Support Article. Administrators should apply the fixes for IBM i 7.5 and 7.6 through standard PTF installation procedures and verify SSH service restart after patching.

Workarounds

Disable the SSH daemon on systems where it is not required by ending the SSHD subsystem and preventing autostart.
Enforce least privilege on user profiles by removing *ALLOBJ special authority from accounts that do not require it.
Apply exit programs to monitor and restrict SSH-related activity until the patch can be deployed.

bash

# Configuration example: end SSHD and verify status on IBM i
ENDTCPSVR SERVER(*SSHD)
WRKACTJOB SBS(QUSRWRK) JOB(SSHD)
# Review object authority on sensitive files
DSPOBJAUT OBJ(QSYS/QUSRSYS) OBJTYPE(*FILE)