CVE-2026-18869: IBM i FTP Auth Bypass Vulnerability

CVE-2026-18869 Overview

CVE-2026-18869 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. The flaw stems from improper validation of File Transfer Protocol (FTP) PORT and EPRT commands. A remote authenticated attacker can abuse this weakness to bypass security restrictions and reach internal network services that would otherwise be unreachable from outside the trusted network boundary.

Critical Impact
Authenticated attackers can pivot through the IBM i FTP service to probe or interact with internal network services, exposing systems that rely on network segmentation for protection.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-09-18 - CVE CVE-2026-18869 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-18869

Vulnerability Analysis

The vulnerability resides in how the IBM i FTP server processes the PORT and EPRT commands. These commands, defined by the FTP protocol, allow a client to specify the IP address and port the server should connect back to for active-mode data transfers. IBM i does not sufficiently validate the destination address supplied through these commands.

Because the server accepts arbitrary destinations, an authenticated FTP client can coerce the server into initiating outbound connections to hosts and ports inside the internal network. This turns the FTP daemon into a proxy for reaching services that are not directly exposed. The vulnerability requires low-privilege authentication and no user interaction, and its scope changes because impact extends beyond the FTP service itself.

Root Cause

The root cause is missing or insufficient validation of user-controlled network parameters in FTP PORT (RFC 959) and EPRT (RFC 2428) command handlers. The FTP server should restrict data connections to the client's control-channel source address. IBM i instead honors attacker-supplied targets, producing a classic SSRF condition [CWE-918].

Attack Vector

An attacker first authenticates to the IBM i FTP service with valid credentials. The attacker then issues a PORT or EPRT command containing the IP address and port of an internal service, followed by an FTP data-transfer command such as LIST or RETR. The FTP server opens a connection to the specified internal target and returns response data or timing information to the attacker. This behavior enables internal port scanning, service enumeration, and interaction with unauthenticated internal services.

No verified proof-of-concept code is publicly available. Refer to the IBM Support Article for vendor-provided technical detail.

Detection Methods for CVE-2026-18869

Indicators of Compromise

Outbound TCP connections originating from the IBM i FTP server process to internal RFC 1918 addresses that are not documented FTP data-transfer destinations.
FTP session logs containing PORT or EPRT commands whose specified IP address does not match the client's control-channel source IP.
Repeated FTP data-channel connection attempts to sequential internal ports, indicating port scanning behavior.

Detection Strategies

Enable FTP command logging on IBM i and parse PORT/EPRT arguments, alerting when the declared address diverges from the authenticated client address.
Correlate FTP authentication events with subsequent outbound connections from the QTCP subsystem to detect proxy-style pivoting.
Baseline normal FTP data-transfer destinations per user account and flag statistical outliers.

Monitoring Recommendations

Forward IBM i FTP audit journals and network flow data to a centralized analytics platform for correlation across authentication, command, and connection events.
Monitor for authenticated low-privilege FTP accounts issuing high volumes of PORT/EPRT commands over short intervals.
Track east-west traffic from IBM i partitions to internal management interfaces, databases, and administrative services.

How to Mitigate CVE-2026-18869

Immediate Actions Required

Apply the IBM-provided Program Temporary Fix (PTF) referenced in the IBM Support Article for each affected release: 7.6, 7.5, 7.4, and 7.3.
Restrict FTP service exposure to trusted management networks using host firewalls and network access control lists.
Audit FTP user accounts and disable or reduce privileges on accounts that do not require FTP access.

Patch Information

IBM has published remediation guidance in the IBM Support Article covering IBM i 7.6, 7.5, 7.4, and 7.3. Administrators should identify the correct PTF group for their release and install it through standard IBM i PTF management procedures.

Workarounds

Disable the IBM i FTP server (ENDTCPSVR SERVER(*FTP)) if it is not required for business operations.
Configure the FTP exit program framework (QIBM_QTMF_SERVER_REQ) to reject PORT and EPRT commands whose target address does not match the client control-channel address.
Enforce passive-mode-only FTP by blocking outbound data connections from the IBM i partition to non-approved destinations at the network firewall.

bash

# Configuration example: disable FTP server on IBM i if not required
ENDTCPSVR SERVER(*FTP)

# Prevent automatic FTP startup at IPL
CHGFTPA AUTOSTART(*NO)

# Verify current FTP server status
WRKACTJOB SBS(QSYSWRK) JOB(QTFTP*)