CVE-2026-18887: IBM i PASE Information Disclosure Flaw

CVE-2026-18887 Overview

CVE-2026-18887 is an information disclosure vulnerability affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. The flaw resides in the Portable Application Solutions Environment (PASE), the AIX runtime layer that lets IBM i execute AIX binaries. An authenticated attacker with local user privileges can query process information they are not authorized to view. The weakness maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. IBM has published a corresponding advisory on its support portal.

Critical Impact
An authenticated attacker can read process-level metadata belonging to other users through PASE, exposing sensitive operational data that may aid follow-on attacks against IBM i systems.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-18887 published to the National Vulnerability Database (NVD)
2026-09-08 - CVE-2026-18887 last updated in the NVD

Technical Details for CVE-2026-18887

Vulnerability Analysis

The vulnerability exists in the Portable Application Solutions Environment (PASE) component of IBM i. PASE provides an AIX-compatible runtime that allows IBM i to execute AIX binaries alongside native ILE workloads. Within this runtime, process-inspection facilities do not adequately enforce access controls, letting an authenticated user retrieve information about processes owned by other principals. The disclosed information can include process arguments, environment variables, and other runtime metadata that should be restricted to the process owner or a privileged account.

Successful exploitation requires only valid low-privilege credentials on the target system. There is no user interaction, and the attack targets confidentiality without altering data or affecting availability. Exposed process metadata can reveal command-line credentials, file paths, job identifiers, and configuration details useful for lateral movement or privilege escalation on the IBM i host.

Root Cause

The root cause is missing or insufficient authorization checks in PASE process-inspection interfaces. Process metadata that should be gated by ownership or profile authority is instead returned to any authenticated caller, violating the principle of least privilege described in CWE-200.

Attack Vector

An attacker authenticates to the IBM i system with any valid user profile capable of launching a PASE shell or invoking PASE utilities. From that context, the attacker enumerates processes running under other users and reads metadata that the operating system should have withheld. Because access is network-reachable through standard IBM i services such as SSH or 5250 emulation into QP2TERM, remote exploitation is feasible once credentials are obtained. Refer to the IBM security bulletin for vendor-provided technical detail.

Detection Methods for CVE-2026-18887

Indicators of Compromise

Unexpected invocations of PASE shells (QP2TERM, QP2SHELL) by user profiles that do not normally run AIX-compatible workloads.
Repeated execution of PASE process-inspection utilities such as ps, procstack, or /proc reads targeting jobs owned by other users.
Anomalous SSH sessions to the IBM i host followed by enumeration of running jobs across multiple user profiles.

Detection Strategies

Audit IBM i journal receivers (QAUDJRN) for PS (profile swap) and CD (command) entries associated with PASE process-inspection commands.
Correlate SSH login events with PASE shell activity and cross-user process enumeration in a centralized log platform.
Baseline normal PASE usage per user profile and alert on deviations, particularly interactive shells launched by service accounts.

Monitoring Recommendations

Forward QAUDJRN and SSH logs to a SIEM for correlation with identity and endpoint telemetry.
Monitor for outbound movement of process metadata or credentials that may have been harvested from other users' command lines.
Track patch inventory for IBM i systems to verify that fixes referenced in the IBM advisory are applied on all LPARs.

How to Mitigate CVE-2026-18887

Immediate Actions Required

Review the IBM support bulletin for node 7285940 and identify all IBM i LPARs running versions 7.3, 7.4, 7.5, or 7.6.
Apply the IBM-provided PTFs for each affected release as soon as the change window allows.
Restrict PASE shell and utility access to user profiles that have a documented business need.

Patch Information

IBM has released fixes documented in the IBM Support Page for Node 7285940. Administrators should download and install the appropriate Program Temporary Fixes (PTFs) for IBM i 7.3, 7.4, 7.5, and 7.6, then verify installation using DSPPTF for each affected product option.

Workarounds

Limit interactive access to PASE by revoking *USE authority on QP2TERM and QP2SHELL for non-administrative profiles.
Enforce least privilege on user profiles and disable unused profiles that can authenticate to SSH or 5250 services.
Avoid passing secrets on command lines within PASE processes; use environment files or vault-backed retrieval to reduce exposure if metadata is read.

bash

# Restrict access to PASE shell entry points on IBM i
RVKOBJAUT OBJ(QSYS/QP2TERM)  OBJTYPE(*PGM) USER(*PUBLIC) AUT(*ALL)
GRTOBJAUT OBJ(QSYS/QP2TERM)  OBJTYPE(*PGM) USER(*PUBLIC) AUT(*EXCLUDE)
GRTOBJAUT OBJ(QSYS/QP2TERM)  OBJTYPE(*PGM) USER(PASEADMIN) AUT(*USE)

# Verify PTF installation status for the affected release
DSPPTF LICPGM(5770SS1)