External risk intelligence

IBM i Unauthorized Access Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-18221

IBM i is an enterprise operating system typically deployed within internal data centers or private networks. While the vulnerability is remotely exploitable, such systems are generally protected by network boundaries and are not commonly exposed directly to the public internet in typical deployments.

Authentication Bypass

Ibm I

7.37.47.57.6

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

IBM i systems, a foundational technology for many businesses, have a critical vulnerability that could permit unauthorized remote access if authentication parameters are not properly validated. This could allow attackers to bypass security controls and potentially access sensitive company information. The main concern is confirming relevance and exposure, as IBM i is typically deployed within protected internal networks.

Flaw allows remote access to IBM i systems.
Critical vulnerability impacts core business systems.
Confirm IBM i systems are not exposed externally.

Attack Path

How an attacker could exploit the issue

An attacker could target IBM i systems over the network without needing any credentials or prior access. The vulnerability lies in how the system handles authentication details provided by a user. If this flaw is exploited, an attacker could gain unauthorized access to the system, potentially leading to control over sensitive information and system functions.

Attacker needs network access.
Improper validation of authentication parameters.
Unauthorized access to sensitive data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to gain unauthorized access to IBM i systems when exposed to the network, potentially impacting system integrity and data confidentiality.

System access and control at risk.
Improper validation of authentication parameters.
Unauthorized system access and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in IBM i affects authentication, potentially allowing unauthorized remote access. Infrastructure or platform teams managing IBM i systems are likely responsible for addressing this. The immediate first step is to identify all instances of the affected IBM i versions, confirm their network exposure and business criticality, and ascertain the accountable system owner before planning remediation.

Own by infrastructure or platform teams.
Verify network exposure and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM i?

IBM i is a secure, integrated operating system designed for enterprise-grade business applications. It provides a robust, scalable platform that manages core business data, database operations, and transaction processing for organizations that require high reliability and long-term data consistency.

What does CVE-2026-18221 mean for security?

This vulnerability is classified as CWE-287, or Improper Authentication. It means the software does not correctly verify the credentials or parameters provided during the login process. Because of this flaw, an attacker could potentially bypass the system's security checks and gain unauthorized entry without providing valid proof of identity.

How does an attacker trigger this IBM i vulnerability?

An attacker triggers this flaw by sending specially crafted authentication parameters over the network to a vulnerable IBM i system. Notably, the vulnerability does not require the attacker to have existing user credentials or prior access to the system. Legitimate activities that do not involve sending authentication requests are not affected by this specific bug.

Is my IBM i system at high risk?

Risk depends largely on your network configuration. According to Halo Surface Signal, IBM i systems are generally deployed within private, internal data centers rather than the public internet. While the vulnerability is technically exploitable remotely, systems shielded by firewalls or strict network boundaries are at lower risk than those directly reachable from the outside.

Do I need to take action on my IBM i servers?

Yes, you should begin by creating a comprehensive inventory of your environment to identify which systems are running the affected versions. Verify the current network configuration for each asset to confirm whether it has direct internet exposure. Once identified, coordinate with your infrastructure or platform teams to prioritize these systems for remediation.

References

www.ibm.com/support/pages/node/7286186

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.