CVE-2026-18846 is a high severity (CVSS 7.5) buffer overflow in IBM i 7.3, 7.4, 7.5 and 7.6 host servers, caused by improperly validated client data. A remote, unauthenticated attacker can send malformed requests to cause denial of service. IBM fixes it with Host Servers PTFs for each release.
What's affected
IBM i 7.3, 7.4, 7.5 and 7.6 are affected. IBM's bulletin lists these Host Servers PTFs for 5770-SS1:
- 7.6: SJ11101, SJ11097
- 7.5: SJ11102, SJ11098
- 7.4: SJ11103, SJ11099
- 7.3: SJ11104, SJ11100
IBM also added PTFs for QFileSvr.400 on 13 August 2026, because the stricter Host Servers PTFs may stop QFileSvr.400 from connecting in some cases: SJ11191 (7.6), SJ11190 (7.5), SJ11189 (7.4) and SJ11188 (7.3). The bulletin lists further component PTFs for Debug Server, Telnet and DRDA/DDM on 7.6. It covers 12 CVEs with scores from 5.3 to 8.8. IBM lists no workaround.
How to check if you're exposed
Check the Host Servers PTFs for your release on each partition:
DSPPTF LICPGM(5770SS1) SELECT(SJ11101)
Repeat for each number, and for the QFileSvr.400 PTF if you use that function. A status of applied shows the fix is in place.
Also check what can reach the host server ports. Host servers handle remote requests from IBM i clients and tools, so they should be reachable only from the networks that need them.
What to do now
- List IBM i partitions and release levels.
- Apply both Host Servers PTFs for your release.
- Test connections that use QFileSvr.400 after the update and apply the QFileSvr.400 PTF if they break.
- Restrict network access to host server ports with firewall rules.
- Apply the other PTFs in the bulletin that match components you use.
Why it matters
The weakness class is CWE-787, an out-of-bounds write. The host server copies data from a client request into a buffer without checking its size. A malformed request that is larger than expected overruns the buffer. IBM describes the result as denial of service for that server.
The vector needs no login and no user interaction, and the effect is on availability only, which gives the score of 7.5. For a core business system, an unauthenticated way to stop a host server is an operational risk, so it belongs in the next maintenance window. The record shows no exploitation and KEV is false.
Quick check
Will the PTFs break anything?
IBM says the stricter Host Servers PTFs may stop QFileSvr.400 connecting in some cases, and published extra PTFs for that.
Does the attacker need to sign in?
No. The vector requires no privileges.
Sources
Last reviewed: 18 October 2026.
