CVE-2026-18235: 
NixOS vulnerability analysis and mitigation

CVE-2026-18235 is an OS command injection vulnerability in IBM i that allows a remote authenticated attacker to execute arbitrary Control Language (CL) commands due to insufficient input validation. It affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The vulnerability was published on August 12, 2026, and carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory, IBM Support).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), where user-supplied input is not adequately sanitized before being incorporated into Control Language command execution on IBM i. An attacker with low-level authenticated network access can inject malicious CL command sequences that are interpreted and executed by the system. No user interaction is required, and attack complexity is low, making this straightforward to exploit once authentication is obtained (GitHub Advisory, IBM Support).

Successful exploitation allows a remote, low-privileged authenticated attacker to execute arbitrary Control Language commands on the affected IBM i system, resulting in high confidentiality and integrity impact and low availability impact. An attacker could read sensitive system data, modify configurations, create or delete objects, and potentially escalate privileges within the IBM i environment. The scope is unchanged, meaning impact is confined to the vulnerable system, but the ability to run arbitrary CL commands represents a significant risk to business-critical IBM i workloads (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.30% (24th percentile), indicating a currently low probability of exploitation within the next 30 days. NVD SSVC assessment notes the vulnerability is not automatable and exploitation has not been observed (GitHub Advisory).

IBM has published a support page (node 7283292) addressing this vulnerability; administrators should consult it for available PTFs (Program Temporary Fixes) applicable to IBM i 7.3, 7.4, 7.5, and 7.6 (IBM Support). As interim mitigations, restrict network access to IBM i systems to trusted and authorized users only, enforce strong authentication controls, and audit user privilege levels to minimize the attack surface. Monitor IBM i job logs and audit journals for unexpected or anomalous Control Language command execution.

A brief mention of the vulnerability appeared on Bluesky via the CyberHub blog shortly after disclosure, indicating some community awareness (GitHub Advisory). No significant vendor statements beyond the IBM support page or notable researcher commentary have been identified at this time.