CVE-2026-18249 is a high severity privilege escalation flaw (CVSS 8.4) in IBM i 7.6, 7.5, 7.4 and 7.3. A remote authenticated attacker could gain elevated privileges because pointers read from Java controlled addresses are not validated properly. IBM bulletin 7283283 has the fixes.
What's affected
Per the record, IBM i 7.6, 7.5, 7.4 and 7.3 are affected. The attacker must already be authenticated. Fixed levels come from IBM's bulletin, which is shared with CVE-2026-18193.
How to check if you're exposed
List installed fixes and your release level, then compare with the bulletin:
DSPPTF
Also review which accounts can run Java on the system, since the flaw involves Java controlled addresses.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Inventory IBM i systems and release levels.
- Apply the fixes named in bulletin 7283283.
- Review accounts with the ability to run Java workloads and remove what is not needed.
- Check audit journals for privilege changes by ordinary users.
Why it matters
The weakness is CWE-269, improper privilege management. The record describes improper validation of pointers read from addresses the Java environment controls. In practice, a low privilege user may be able to act with more rights than intended.
The attack needs a login, which limits the audience, but a changed scope and high impact make it worth the quick fix on shared systems. The CVE is not in CISA's KEV list.
Quick check
Does it need a valid login?
Yes. The record says a remote authenticated attacker.
Which bulletin?
IBM's 7283283, shared with CVE-2026-18193.
Sources
Last reviewed: 19 October 2026.
