IBM i versions 7.3 through 7.6 contain a vulnerability classified as CWE-269 (Improper Privilege Management). This flaw allows a local attacker to escalate privileges by exploiting improper management of thread authority swaps within the system. The vulnerability has a CVSS 3.1 base score of 8.8, reflecting low attack complexity but requiring local access and resulting in high impact on confidentiality, integrity, and availability. The vulnerability is published and assigned CVE-2026-18101. No vendor advisory or patch information is currently available.

A local attacker with access to the affected IBM i systems could exploit this vulnerability to gain elevated privileges. This could lead to full system compromise, including unauthorized access to sensitive data, modification of system resources, and disruption of system availability. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released by IBM, organizations should restrict local access to trusted users only and monitor for suspicious activity related to privilege escalation attempts.