IBM i Vulnerability Advisory: CVE-2026-18318/17484/17487 Brute Force/DoS

Vulnerability Overview IBM i is affected by multiple vulnerabilities, specifically: 1. CVE-2026-18318 - Description: IBM allows remote attackers to obtain credentials via brute force due to improper authentication. - CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts - CVSS Base Score: 5.3 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) 2. CVE-2026-17484 - Description: IBM allows local attackers to cause a denial of service due to improper access control. - CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - CVSS Base Score: 5.3 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) 3. CVE-2026-17487 - Description: IBM allows remote attackers to enumerate user profiles by returning different error codes during the login process. - CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - CVSS Base Score: 5.3 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Affected Products Affected Product: IBM i Affected Versions: 7.6, 7.5, 7.4, 7.3 Remediation Remediation Versions: - IBM i 7.6: PTF M311636, M311441 - IBM i 7.5: PTF M311635, M311439 - IBM i 7.4: PTF M311634, M311438 - IBM i 7.3: PTF M311633, M311448 Remediation Links: - IBM i 7.6 Remediation Link - IBM i 7.5 Remediation Link - IBM i 7.4 Remediation Link - IBM i 7.3 Remediation Link Additional Information Workarounds: None Reference Links: - Full CVSS v3 Specification - Online Calculator v3 Disclaimer The Common Vulnerability Scoring System (CVSS) is an "industry open standard," as defined by the Forum of Incident Response and Security Teams (FIRST), designed to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is" without any express or implied warranties, including but not limited to implied warranties of merchantability and fitness for a particular purpose. It is the customer's responsibility to assess the impact of the vulnerability on their environment. IBM periodically updates component records for products included in its portfolio. As part of this effort, IBM identifies previously unreported packages in product and service lists, addressing relevant vulnerabilities regardless of the CVE date. The inclusion of an older CVE ID does not indicate that the referenced product has been used by IBM since that date, nor does it indicate that IBM was aware of the vulnerability prior to that date. We are alerting customers to vulnerabilities affecting them. The "Affected Products and Versions" referenced in IBM security bulletins refer only to IBM-supported and released versions, and are not past their end-of-support or warranty dates. Therefore, the omission of unsupported or extended-support products and versions in this security bulletin does not constitute a determination by IBM that they are not affected by the vulnerability. Citing one or more unsupported versions in this security bulletin does not obligate IBM to remediate any unsupported or extended-support products or versions. Cross-Reference Information Change History September 29, 2026: Initial release The CVSS Environmental score is specific to the customer's environment and will ultimately affect the overall CVSS score. Customers can assess the impact of the vulnerability in their environment by accessing the links in the references section of this security bulletin.

Goal Reached Thanks to every supporter — we hit 100%!

IBM i Vulnerability Advisory: CVE-2026-18318/17484/17487 Brute Force/DoS

More from this source