IBM i Navigator for i Vulnerabilities Advisory: RCE, XSS, PrivEsc (CVEs)

Vulnerability Overview IBM i is affected by multiple vulnerabilities in Navigator for i. These vulnerabilities include: CVE-2026-17266: Allows a remote authenticated attacker to obtain sensitive information via improper pathname restrictions. CVE-2026-18235: Allows a remote authenticated attacker to execute arbitrary control language commands via improper input validation. CVE-2026-17268: Allows a remote authenticated attacker to bypass security restrictions via improper session token validation. CVE-2026-17276: Allows a remote authenticated attacker to escalate privileges via improper handling of high-privilege threads. CVE-2026-18250: Allows a remote authenticated attacker to obtain sensitive information and bypass security restrictions via improper synchronization of shared resources. CVE-2026-18713: Allows an authenticated user to escalate privileges to the root user to execute commands via Navigator for i. CVE-2026-16904: Allows a remote authenticated attacker to execute arbitrary commands via improper reassignment of monitor owners. CVE-2026-18148: Allows a remote authenticated attacker to inject arbitrary content into Navigator for i log files via improper log output sanitization. CVE-2026-18847: Allows a remote unauthenticated attacker to collect credentials by spoofing Navigator for i. CVE-2026-16694: Allows an authenticated user to inject arbitrary JavaScript code via the Web UI, resulting in cross-site scripting (XSS). CVE-2026-17094: Allows a remote authenticated attacker to obtain sensitive information and manipulate files via a path traversal vulnerability. CVE-2026-17095: Allows a remote authenticated attacker to bypass security restrictions via insecure reflection. CVE-2026-18246: Allows a remote authenticated attacker to bypass security restrictions via multi-parser interpretation conflicts. CVE-2026-18106: Allows a remote authenticated attacker to obtain sensitive information via improper input validation for user-supplied paths. CVE-2026-66010: Versions of DOMPurify prior to 3.4.12 failed to execute the hook, allowing attackers to retain sensitive attributes and create second-order XSS attacks. CVE-2026-18144: Allows a remote authenticated attacker to bypass security restrictions via improper authorization. CVE-2026-18099: Allows a remote authenticated attacker to execute arbitrary script code via improper sanitization of user-controlled input. CVE-2026-18150: Allows a remote authenticated attacker to obtain sensitive information via a race condition. CVE-2026-18098: Allows a remote authenticated attacker to obtain sensitive information and compromise system integrity via an XML injection vulnerability. CVE-2026-18683: Allows an authenticated user to escalate privileges to the root user to execute commands via Navigator for i. CVE-2026-17099: Allows a remote attacker to obtain sensitive information via improper authentication. CVE-2026-17101: Allows a remote attacker to execute arbitrary code or obtain sensitive information via improper authentication. Affected Versions IBM i 7.6 IBM i 7.5 IBM i 7.4 IBM i 7.3 Remediation IBM strongly advises users to upgrade to supported and patched versions. The following remediation steps apply to the respective versions: IBM i 7.6: PTF number 5310887, download link: https://www.ibm.com/mysupport/s/fix-information?legacy=5310887 IBM i 7.5: PTF number 5310888, download link: https://www.ibm.com/mysupport/s/fix-information?legacy=5310888 IBM i 7.4: PTF number 5310890, download link: https://www.ibm.com/mysupport/s/fix-information?legacy=5310890 IBM i 7.3: PTF number 5310891, download link: https://www.ibm.com/mysupport/s/fix-information?legacy=5310891 Workaround Mitigations None. References Complete CVSS v3 Guide Online Calculator v3 Additional Information IBM Security Engineering Web Portal IBM Product Security Incident Response Blog Acknowledgments None. Change History August 11, 2026: Initial release Disclaimer IBM provides vulnerability ratings "as is," with no express or implied warranties, in accordance with the Common Vulnerability Scoring System (CVSS) of the Forum of Incident Response and Security Teams (FIRST). Customers are responsible for evaluating the impact of vulnerabilities on their actual or potential security vulnerabilities. IBM periodically updates component records in the product/service inventory to address known vulnerabilities. IBM identifies vulnerabilities previously unidentified, regardless of the CVE date. Inclusion of older CVE IDs does not indicate that IBM was aware of the vulnerability from that date, nor does it indicate that IBM was unaware of the vulnerability prior to that date. We make customers aware of relevant vulnerabilities as we become aware of them. The IBM Security Advisories referenced in the "Affected Products and Versions" section are intended to include only products and versions supported and maintained by IBM. Failure to reference unsupported or extended support products and versions does not constitute

Goal Reached Thanks to every supporter — we hit 100%!

IBM i Navigator for i Vulnerabilities Advisory: RCE, XSS, PrivEsc (CVEs)

More from this source