CVE-2026-18887: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

This vulnerability (CVE-2026-18887) affects IBM i operating system versions 7.3 through 7.6. It involves an information disclosure flaw (CWE-200) where an authenticated attacker can access sensitive process information in the PASE environment that should be restricted. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The vulnerability does not impact integrity or availability, only confidentiality. No vendor advisory or patch information is currently available, and no known exploitation has been reported.

An authenticated attacker can gain unauthorized access to sensitive information about processes running in the PASE environment on affected IBM i versions. This could lead to information disclosure that may aid further attacks or compromise confidentiality. There is no impact on system integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, monitor IBM's security advisories for updates. Until a fix is available, restrict authenticated user privileges to limit exposure.