CVE-2026-18175 is a high severity (CVSS 8.1) improper authorization flaw in the DDM target dispatcher of IBM i 7.3, 7.4, 7.5 and 7.6. A remote attacker could manipulate database transactions. IBM fixes it with PTFs for 5770-SS1 on each release and lists no workaround.
What's affected
IBM's bulletin lists IBM i 7.3, 7.4, 7.5 and 7.6 as affected. The fixes are PTFs for product 5770-SS1:
- 7.6: SJ11230, SJ11231
- 7.5: SJ11232, SJ11233
- 7.4: SJ11261, SJ11262
- 7.3: SJ11234, SJ11235
The bulletin covers two related DDM and DRDA issues, this one (improper authorization) and CVE-2026-18221 (improper authentication), and does not map each PTF to a single CVE. Apply both PTFs for your release. IBM also notes no mitigations and recommends moving unsupported versions to a supported, fixed release.
How to check if you're exposed
On the IBM i system, display the installed level and check for the PTFs. A command such as the following shows the status of a given PTF for the base operating system product:
DSPPTF LICPGM(5770SS1) SELECT(SJ11230)
Run it for each PTF listed for your release and look for a status of applied. IBM's bulletin and Fix Central give the authoritative PTF details if the display differs.
Also list which systems expose DDM and DRDA services, which are the distributed database access servers, and who can reach them from the network.
What to do now
- List every IBM i partition and its release.
- Order and apply both PTFs listed for your release from IBM Fix Central.
- Schedule an IPL if the PTF cover letters require one.
- Restrict network access to the DDM and DRDA server ports to the hosts that need them.
- Review audit journal entries for unexpected database activity from remote clients with your usual tooling.
Why it matters
The weakness class is CWE-285, improper authorization. The system accepts a request that comes in through the distributed data management layer without enforcing the check that should decide whether that caller may perform the action. When that happens in a database path, a caller can change or influence transactions that belong to someone else.
The score reflects a network attack with high attack complexity and a changed scope, with high integrity impact. No exploitation is reported in the record, and the KEV flag is false. Since IBM i often holds core business data, even a hard to exploit database integrity flaw is worth patching in the next maintenance window.
Quick check
Which PTF fixes this particular CVE?
IBM's bulletin lists two PTFs per release and does not map them to individual CVEs. Apply both for your release.
Is there a workaround?
IBM lists none. Limiting network access to DDM services reduces exposure but does not replace the PTFs.
Sources
Last reviewed: 18 October 2026.
