IBM i Multiple Vulnerabilities Advisory: CVE-2026-18193, 249, 476 with PTF Fixes

Vulnerability Overview IBM i is affected by multiple vulnerabilities, specifically: 1. CVE-2026-18193 - Description: IBM i may allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses. - CWE: CWE-269: Improper Privilege Management - CVSS Base Score: 8.9 - CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L) 2. CVE-2026-18249 - Description: IBM i may allow a remote authenticated attacker to gain elevated privileges due to improper reading of pointers from Java-controlled addresses. - CWE: CWE-269: Improper Privilege Management - CVSS Base Score: 8.4 - CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) 3. CVE-2026-17476 - Description: IBM i may allow a remote attacker to cause a denial of service due to an incorrect buffer write. - CWE: CWE-787: Out-of-bounds Write - CVSS Base Score: 4.8 - CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Impact Scope Affected Product: IBM i Affected Versions: 7.6, 7.5, 7.4, 7.3 Remediation IBM strongly recommends addressing these vulnerabilities immediately. Below are the remediation packages for different versions: IBM i 7.6 PTF Numbers: S311037, S311013, S311065, S311078 PTF Download Links: - https://www.ibm.com/mysupport/s/fix-information?legacy=S311037 - https://www.ibm.com/mysupport/s/fix-information?legacy=S311013 - https://www.ibm.com/mysupport/s/fix-information?legacy=S311065 - https://www.ibm.com/mysupport/s/fix-information?legacy=S311078 IBM i 7.5 PTF Numbers: S310990, S311014, S311066, S311080 PTF Download Links: - https://www.ibm.com/mysupport/s/fix-information?legacy=S310990 - https://www.ibm.com/mysupport/s/fix-information?legacy=S311014 - https://www.ibm.com/mysupport/s/fix-information?legacy=S311066 - https://www.ibm.com/mysupport/s/fix-information?legacy=S311080 IBM i 7.4 PTF Numbers: S311016, S311041, S311064, S311081 PTF Download Links: - https://www.ibm.com/mysupport/s/fix-information?legacy=S311016 - https://www.ibm.com/mysupport/s/fix-information?legacy=S311041 - https://www.ibm.com/mysupport/s/fix-information?legacy=S311064 - https://www.ibm.com/mysupport/s/fix-information?legacy=S311081 IBM i 7.3 PTF Numbers: S311040, S311063, S311079 PTF Download Links: - https://www.ibm.com/mysupport/s/fix-information?legacy=S311040 - https://www.ibm.com/mysupport/s/fix-information?legacy=S311063 - https://www.ibm.com/mysupport/s/fix-information?legacy=S311079 Additional Information Workarounds: None References: - Complete CVSS v3 Guide - On-line Calculator v3 Related Resources: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard” intended to convey vulnerability severity and help determine response urgency and prioritization. IBM provides CVSS scores “AS IS” and without any express or implied warranties, including but not limited to warranties of merchantability and fitness for a particular purpose. Customers are responsible for evaluating the impact of any actual or potential security vulnerabilities. Furthermore, to mitigate potential vulnerabilities, IBM periodically updates the component records included in its product offerings. As part of this effort, if IBM identifies previously unrecognized packages within its product/service inventory, it will address related vulnerabilities regardless of the CVE date. The inclusion of an older CVEID does not indicate that the referenced product has been used by IBM, nor does it indicate that IBM was aware of the vulnerability prior to that date. We are raising customer awareness of vulnerabilities affecting us. The referenced “Affected Products and Versions” are intended to include only IBM-supported, non-legacy products and versions. Therefore, references to unsupported or extended support products and versions do not constitute a determination by IBM that they are unaffected by the vulnerability. References to one or more unsupported versions do not constitute an obligation by IBM to provide fixes for any unsupported or extended support product or version. Cross-reference Information Product: - IBM i - IBM i 7.3 Preventative Service Planning - IBM i 7.4 Preventative Service Planning - IBM i 7.5 Preventative Service Planning - IBM i 7.6 Preventative Service Planning Change History August 12, 2026: Initial release The CVSS Environment Score is customer environment specific and will ultimately impact the overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environment by accessing the links referenced in the References section of this security advisory.

Goal Reached Thanks to every supporter — we hit 100%!

IBM i Multiple Vulnerabilities Advisory: CVE-2026-18193, 249, 476 with PTF Fixes

More from this source