CVE-2026-18847 is a high severity spoofing flaw (CVSS 8.8) in IBM i 7.6, 7.5, 7.4 and 7.3. A remote unauthenticated attacker could harvest credentials by spoofing Navigator for i. A user must take an action, so training matters as well as the fix in IBM bulletin 7283292.
What's affected
Per the record, IBM i 7.6, 7.5, 7.4 and 7.3 are affected. The record does not list fixed levels. IBM's bulletin 7283292 is the source for the PTFs.
How to check if you're exposed
Show installed fixes and release on each system:
DSPPTF
Then compare with the bulletin. Also note who uses Navigator for i and from where.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- Identify IBM i systems running Navigator for i.
- Apply the fixes in bulletin 7283292.
- Remind administrators to reach Navigator for i only through bookmarked or known addresses.
- Limit access to the Navigator for i port to administration networks.
Why it matters
The weakness is CWE-346, origin validation error. Spoofing here means a user can be led to a fake or misrepresented Navigator for i and enter credentials there. The vector requires user interaction, which fits that story.
Credentials for an administration console are valuable. A fix plus network limits and user habits together close most of the exposure. The CVE is not in CISA's KEV list.
Quick check
Does the attacker need access first?
No. The record says remote unauthenticated, but a user must interact.
What helps besides the fix?
Using bookmarked addresses and limiting who can reach the console.
Sources
Last reviewed: 19 October 2026.
