CVE-2026-18713: 
NixOS vulnerability analysis and mitigation

CVE-2026-18713 is a privilege escalation vulnerability in IBM i (formerly AS/400) affecting versions 7.3, 7.4, 7.5, and 7.6, exploitable through the Navigator for i web-based administration interface. An authenticated network user can elevate their privileges to root and execute arbitrary commands on the affected system. The vulnerability was published on August 12, 2026, and carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, IBM Support).

The vulnerability is classified as CWE-269 (Improper Privilege Management), indicating that the Navigator for i component fails to properly assign, track, or enforce privilege boundaries for authenticated users. An attacker with low-level network access and valid credentials can abuse the Navigator for i interface to escalate their privileges to root without requiring additional user interaction. The attack vector is network-accessible, requires low privileges, and has low complexity, making it straightforward to exploit once authenticated. No specific technical write-up or public proof-of-concept code has been identified at this time (GitHub Advisory, IBM Support).

Successful exploitation grants an authenticated attacker root-level access on the affected IBM i system, resulting in complete compromise of confidentiality, integrity, and availability. An attacker could execute arbitrary commands, access or exfiltrate sensitive data, modify system configurations, install persistent backdoors, or disrupt critical business operations running on IBM i. Given IBM i's common use in enterprise and financial environments for mission-critical workloads, the potential business impact is significant (GitHub Advisory).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation (IBM Support). The EPSS score is approximately 0.508%, placing it in the 41st percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. SSVC assessment indicates exploitation is not automated and no exploitation has been observed (GitHub Advisory).

IBM has published a support page (node/7283292) addressing this vulnerability; administrators should consult it for applicable PTFs (Program Temporary Fixes) for IBM i 7.3, 7.4, 7.5, and 7.6 (IBM Support). As interim mitigations, organizations should restrict network access to the Navigator for i interface to trusted hosts and networks only, enforce the principle of least privilege for all IBM i user profiles, and monitor audit logs for unexpected privilege escalation events. Disabling Navigator for i entirely is recommended if the component is not operationally required.