CVE-2026-18250: 
NixOS vulnerability analysis and mitigation

CVE-2026-18250 is a race condition vulnerability in IBM i (formerly AS/400) that allows a remote authenticated attacker to obtain sensitive information and bypass security restrictions. It affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The vulnerability was published on August 12, 2026, and is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). It carries a CVSS v3.1 base score of 6.3 (Medium) per the GitHub Advisory Database, or 5.0 (Medium) per NVD scoring with higher attack complexity (GitHub Advisory, IBM Support).

The vulnerability is rooted in a race condition (CWE-362) within IBM i's concurrent execution handling, where a timing window exists during which a shared resource can be modified by a competing code sequence before access controls are fully enforced. This falls under CAPEC-26 (Leveraging Race Conditions) and CAPEC-29 (Leveraging Time-of-Check and Time-of-Use / TOCTOU Race Conditions). An attacker must be remotely authenticated with low-level privileges and exploit the timing window to read sensitive data or circumvent security restrictions. No public proof-of-concept or detailed technical write-up has been disclosed at this time (GitHub Advisory, IBM Support).

Successful exploitation allows a remote authenticated attacker with low privileges to obtain sensitive information and bypass security restrictions on affected IBM i systems, resulting in low-level impacts to confidentiality, integrity, and availability. The scope is unchanged, meaning the impact is contained to the vulnerable IBM i system itself without direct lateral movement to other components. However, access to sensitive information could facilitate further attacks or privilege escalation within the IBM i environment (GitHub Advisory, IBM Support).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time, as confirmed by NVD SSVC data indicating exploitation status as "none" and non-automatable attack characteristics. The EPSS score is approximately 0.19%, reflecting a low near-term exploitation probability. The vulnerability requires authenticated access with low privileges and high attack complexity (per NVD scoring), making opportunistic exploitation less likely. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, IBM Support).

IBM has published a support page (node 7283292) addressing this vulnerability; administrators should consult it for specific PTF (Program Temporary Fix) details applicable to their IBM i release (7.3, 7.4, 7.5, or 7.6). As interim mitigations, organizations should restrict network access to affected IBM i systems, limit authenticated user privileges to the minimum necessary, and implement enhanced monitoring for anomalous access patterns. Applying IBM's official security updates as soon as they are available is the recommended long-term remediation (IBM Support, GitHub Advisory).