CVE-2026-18509 is a high severity (CVSS 8.2) privilege escalation in the Navigator for i debugger on IBM i 7.3, 7.4, 7.5 and 7.6. An authenticated attacker could read or change sensitive data or create profiles with elevated privileges. IBM fixes it with a Navigator PTF and a Debug Service PTF per release.
What's affected
IBM i 7.3, 7.4, 7.5 and 7.6 are affected. IBM's bulletin lists two PTFs per release for product 5770-SS1:
- 7.6: SJ10887 (Navigator), SJ11126 (Debug Service)
- 7.5: SJ10888 (Navigator), SJ11125 (Debug Service)
- 7.4: SJ10890 (Navigator), SJ11124 (Debug Service)
- 7.3: SJ10891 (Navigator), SJ11128 (Debug Service)
IBM lists no workaround. One detail differs between sources. The NVD description calls the attacker local and authenticated, while the CVSS vector in the record and in IBM's bulletin uses a network attack vector with high complexity and a changed scope. Read both as meaning that a signed in user is required, and that the debug service is reachable from the network in some setups.
How to check if you're exposed
Check that both PTFs for your release are applied on each partition:
DSPPTF LICPGM(5770SS1) SELECT(SJ10887)
DSPPTF LICPGM(5770SS1) SELECT(SJ11126)
Substitute the numbers for your release. A status of applied means the fix is installed.
Then check whether the debug service is running and who can reach it. Debug services are meant for developers, so on production partitions they are often unnecessary. Review the network paths to the Navigator and debug ports and the profiles that have access.
What to do now
- List IBM i partitions and release levels.
- Apply both the Navigator PTF and the Debug Service PTF for your release.
- Disable the debug service on production partitions where it is not needed.
- Restrict network access to Navigator for i and debug ports to administrator workstations.
- Review user profiles for unexpected additions with high authority, and check special authorities on existing ones.
- Audit who has the authority to use the debugger and remove it from accounts that do not need it.
Why it matters
The weakness class is CWE-285, improper authorization. A feature built for developers allows an action that the signed in user should not be able to take, including creating profiles with elevated rights. On IBM i, a profile with special authorities such as all object access is close to full control of the system.
That is why a flaw that needs a normal login can still be rated high. The key lesson is that debugging and admin tooling should be treated as production attack surface. IBM does not report exploitation and the KEV flag is false.
Quick check
Why are there two PTFs per release?
IBM lists one for Navigator and one for the Debug Service. Apply both to cover the bulletin.
Is this local or remote?
The description says local authenticated, while the CVSS vector uses a network vector. Plan as if a signed in user could reach it from the network.
Sources
Last reviewed: 18 October 2026.
