CVE-2026-18065

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.

Scoring

Severity

MEDIUM

CVSS base score

5.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS probability

0.31%

CWE

CWE-290

Published

2026-09-14

Last modified

2026-09-15

Affected products

• IBM i
• IBM i
• IBM i
• IBM i

Weakness type

• CWE-290

Related vulnerabilities

• CVE-2026-25938 — FUXA Unauthenticated Remote Code Execution in Node-RED Integration
• CVE-2026-27478 — Unity Catalog has a JWT Issuer Validation Bypass Allows Complete User Impersonation
• CVE-2025-11250 — Authentication Bypass
• CVE-2026-33654 — Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling
• CVE-2026-31889 — Shopware has a potential take over of app credentials
• CVE-2026-33661 — WeChat Pay callback signature verification bypassed when Host header is localhost
• CVE-2026-76423 — Cisco ISE API Authentication Bypass Vulnerability
• CVE-2026-6213 — Remote Spark SparkView RCE

Markdown version · Browse all CVEs