CVE-2026-18221 is a high severity authentication flaw (CVSS 8.1) in IBM i 7.6, 7.5, 7.4 and 7.3. A remote attacker could gain unauthorized access because client supplied authentication parameters are not validated properly. IBM's bulletin 7286186 lists the fixes, so apply the one for your release and limit network exposure of the system.
What's affected
Per the CVE record, IBM i 7.6, 7.5, 7.4 and 7.3 are affected. Fixed levels are not in the record. Take them from IBM's bulletin for your release.
How to check if you're exposed
Record your IBM i release and installed fixes, then compare them with the bulletin:
DSPPTF
If the needed fix is missing, schedule it.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Identify each IBM i system and its release.
- Read bulletin 7286186 and select the fix for each release.
- Apply the fix in a maintenance window.
- Limit network exposure of IBM i services to the hosts that need them.
Why it matters
The weakness is CWE-287, improper authentication. The record ties it to client supplied authentication parameters being accepted without enough validation. The vector shows a network attack with high complexity and no privileges, with high impact on confidentiality, integrity and availability.
High complexity means conditions must line up for an attacker, but the outcome is full access. Keeping IBM i services off untrusted networks is a good layer of defense either way. The CVE is not in CISA's KEV list.
Quick check
Do attackers need an account?
The record says no privileges are required.
What lowers the risk right now?
Network limits on IBM i services, then the fix.
Sources
Last reviewed: 19 October 2026.
