Ibm I vulnerabilities

CVE-2026-96119 Critical · 9.9 CWE-94 Oct 12, 2026

IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

CVE-2026-93886 Medium · 5.4 CWE-79 Oct 12, 2026

IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

CVE-2026-81858 High · 8.1 CWE-125 Oct 12, 2026

IBM i is Affected By A Denial of Service Vulnerability in Host Servers

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

CVE-2026-18343 Medium · 4.4 CWE-269 Oct 12, 2026

IBM i is Affected By An Improper Privilege Management Vulnerability

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

CVE-2026-18318 Medium · 5.3 CWE-307 Oct 12, 2026

IBM i Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

CVE-2026-17487 Medium · 5.3 CWE-200 Oct 12, 2026

IBM i is Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.

CVE-2026-17484 Medium · 5.5 CWE-200 Oct 12, 2026

IBM i is Information Disclosure

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control.

CVE-2026-18102 Medium · 4.3 CWE-122 Aug 19, 2026

Heap-based Buffer Overflow in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to overwrite adjacent memory due to an integer underflow during bounds checking.

CVE-2026-17015 High · 8.1 CWE-125 Aug 19, 2026

Out-of-bounds Read in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds read.

CVE-2026-18715 Medium · 6.5 CWE-611 Aug 13, 2026

XML External Entity (XXE) in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.

CVE-2026-18671 Medium · 5.3 CWE-190 Aug 13, 2026

Integer Overflow or Wraparound in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to force a NetServer server thread exception, caused by an integer overflow during bounds checking in request processing. The attacker could exploit this vulnerability to cause a temporary denial of service.

CVE-2026-18511 High · 7.8 CWE-787 Aug 13, 2026

Out-of-bounds Write in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary code on the system or cause the JVM process to crash.

CVE-2026-18509 High · 7.1 CWE-285 Aug 13, 2026

Improper Authorization in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system.

CVE-2026-18249 Critical · 9.9 CWE-269 Aug 13, 2026

Improper Privilege Management in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses.

CVE-2026-18193 Critical · 10.0 CWE-269 Aug 13, 2026

Improper Privilege Management in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses.

CVE-2026-18101 High · 8.8 CWE-269 Aug 13, 2026

Improper Privilege Management in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper management of thread authority swaps.

CVE-2026-18086 Medium · 5.3 CWE-787 Aug 13, 2026

Out-of-bounds Write in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds checking.

CVE-2026-18077 High · 7.5 CWE-787 Aug 13, 2026

Out-of-bounds Write in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.

CVE-2026-18068 Medium · 4.3 CWE-200 Aug 13, 2026

Exposure of Sensitive Information in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and element-count confusion.

CVE-2026-18020 Medium · 5.3 CWE-125 Aug 13, 2026

Out-of-bounds Read in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking.

CVE-2026-17649 Medium · 5.3 CWE-125 Aug 13, 2026

Out-of-bounds Read in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

CVE-2026-17502 High · 7.5 CWE-787 Aug 13, 2026

Out-of-bounds Write in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

CVE-2026-17476 Medium · 5.3 CWE-787 Aug 13, 2026

Out-of-bounds Write in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write.

CVE-2026-17438 Medium · 4.4 CWE-269 Aug 13, 2026

Improper Privilege Management in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management.

CVE-2026-17272 High · 7.5 CWE-787 Aug 13, 2026

Out-of-bounds Write in Ibm I

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow.