CVE-2026-18713 is a high severity (CVSS 8.8) privilege escalation in Navigator for i on IBM i 7.3, 7.4, 7.5 and 7.6. An authenticated user could elevate to root and run commands. IBM fixes it with PTF SJ10887 (7.6), SJ10888 (7.5), SJ10890 (7.4) and SJ10891 (7.3).
What's affected
IBM i 7.3, 7.4, 7.5 and 7.6 are affected. IBM's bulletin lists these PTFs for 5770-SS1 option 3:
- 7.6: SJ10887
- 7.5: SJ10888
- 7.4: SJ10890
- 7.3: SJ10891
The bulletin covers 22 CVEs, with the highest score at 9.6 for a different issue about high authority threads. IBM lists no workaround and strongly recommends addressing the vulnerabilities now. This CVE and CVE-2026-18683 are both scored 8.8 for privilege escalation to root. The record's CVSS 3.1 score of 8.8 matches the bulletin.
How to check if you're exposed
Check that the PTF for your release is applied on each partition:
DSPPTF LICPGM(5770SS1) SELECT(SJ10887)
Use your release's PTF number. A status of applied means the fix is installed.
Then review how Navigator for i is exposed. The web interface is a management console, so it should be limited to administrator networks. List the profiles that can sign in to it.
What to do now
- List IBM i partitions and release levels.
- Apply the Navigator PTF for your release from IBM Fix Central.
- Apply the rest of the bulletin, which covers 22 CVEs.
- Restrict the Navigator for i interface to administrator workstations.
- Review user profiles and special authorities for unexpected changes.
- Review audit journal entries for commands run by unusual profiles.
Why it matters
The weakness class is CWE-269, improper privilege management. Navigator accepts a request from a signed in user and ends up running a command with the rights of root, instead of the user's own. A management console typically runs with strong rights so that it can do its job, so every flaw in how it checks the caller carries a large reward.
The score of 8.8 follows from a network attack by a low-privileged user, with no user interaction and high impact on all three categories. The sensible response is to treat management interfaces as sensitive. Keep them off general networks, apply PTFs promptly, and review who can log in. KEV status is false.
Quick check
Is one PTF enough for all the CVEs in the bulletin?
IBM lists a single Navigator PTF per release for 5770-SS1 option 3, so applying it covers the bulletin.
Who can exploit this?
An authenticated user, per the record. Low privilege is enough under the CVSS vector.
Sources
Last reviewed: 18 October 2026.
