IBM i versions 7.3 through 7.6 contain a vulnerability identified as CVE-2026-18086, classified under CWE-787 (Out-of-bounds Write). This flaw arises from improper bounds checking, enabling a local attacker with low privileges to potentially execute arbitrary code or trigger a denial of service condition. The CVSS 3.1 base score is 4.5, reflecting medium severity with local attack vector, high attack complexity, and no user interaction required. As of the published date, no vendor remediation or patch has been confirmed.

A successful exploitation of this vulnerability could allow a local attacker to execute arbitrary code or cause a denial of service on affected IBM i systems. The impact includes potential confidentiality, integrity, and availability loss, but exploitation requires local access and has high complexity, limiting the risk scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for unusual activity related to IBM i systems.