CVE-2026-18869 is a Server-Side Request Forgery (SSRF) vulnerability affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. The issue arises from improper validation of FTP PORT and EPRT commands, which can be exploited by a remote authenticated attacker to bypass security restrictions and access internal network services. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.4, indicating a network attack vector with low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no impact on availability. There is no information about patches or vendor advisories currently available.

An authenticated remote attacker could exploit this vulnerability to bypass security restrictions and gain unauthorized access to internal network services. This could lead to partial confidentiality and integrity compromise of affected systems. There is no indication of availability impact or known active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to FTP services to trusted users and monitor for suspicious FTP command usage. Avoid exposing IBM i FTP services to untrusted networks.