IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.
Summary
| CVE | CVE-2026-18515 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-14 19:17:16 UTC |
| Updated | 2026-09-16 19:22:22 UTC |
| Description | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but only if the profile could already do that by itself. |
Risk And Classification
Primary CVSS: v3.1 4.3 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.002770000 probability, percentile 0.202340000 (date 2026-09-16)
Problem Types: CWE-22 | CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| 3.1 | CNA | CVSS | 4.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.ibm.com/support/pages/node/7286974 | [email protected] | www.ibm.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: IBM strongly recommends addressing the vulnerability now. IBM i Release5770-SS1 Option 3 PTF Number(s)PTF Download Link(s)7.6SJ11196 SJ11337 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11196 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11337 7.5SJ11197 SJ11336 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11197 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11336 7.4SJ11200 SJ11335 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11200 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11335 7.3SJ11187 SJ11394 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11187 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11394 IBM i Release5770-SS1 Option 34 PTF Number(s)PTF Download Link(s)7.6SJ11377 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11377 7.5SJ11376 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11376 7.4SJ11375 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11375 7.3SJ11374 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11374 IBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.