CVE-2026-18193 is a high severity flaw (CVSS 8.9) in IBM i 7.6, 7.5, 7.4 and 7.3. A remote attacker could bypass security restrictions because user controlled addresses are not validated properly. IBM lists the fixes in a bulletin shared with CVE-2026-18249, so apply what it names.
What's affected
The CVE record names IBM i 7.6, 7.5, 7.4 and 7.3. It does not give fixed levels. IBM's bulletin 7283283 covers this CVE and CVE-2026-18249, and it is the source for the PTF or fix pack to install.
How to check if you're exposed
On the system, display your release and installed fixes with the standard IBM i commands, then compare them with the bulletin:
DSPPTF
Check your operating system release level too. The bulletin tells you which fixes address which release.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- List your IBM i partitions and their release levels.
- Open bulletin 7283283 and pick the fixes for each release.
- Schedule the PTF install and the IPL it may need.
- After the install, confirm the fix is applied and reload your inventory.
Why it matters
The weakness is CWE-269, improper privilege management. The record ties it to improper validation of user controlled addresses. The CVSS vector shows a network attack with high complexity, no privileges and a changed scope, with high confidentiality and integrity impact.
High complexity lowers the odds, but a changed scope means a successful attack can reach beyond the component that failed. The CVE is not in CISA's KEV list.
Quick check
Are all four releases affected?
Yes, per the record: 7.3, 7.4, 7.5 and 7.6.
Is it the same as CVE-2026-18249?
No. They share an IBM bulletin but are separate flaws.
Sources
Last reviewed: 19 October 2026.
