Threat Intelligence Database

CVE-2026-18099 is a high-severity cross-site scripting (XSS) vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It allows a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input during web page generation. This vulnerability requires user interaction and privileges to exploit. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability that allows a remote authenticated attacker to bypass security restrictions by exploiting improper validation of a user profile name. This flaw could lead to execution with unnecessary privileges, potentially compromising confidentiality and integrity of the system.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.

IBM i versions 7.3 through 7.6 are affected by a SQL injection vulnerability (CWE-89) that allows a remote attacker with low privileges to send specially crafted SQL commands. This could enable unauthorized viewing, modification, addition, or deletion of data in the backend database. The vulnerability has a high severity with a CVSS score of 7.6. No official patch or remediation guidance is currently available from the vendor.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation.