CVE-2026-18715: 
NixOS vulnerability analysis and mitigation

CVE-2026-18715 is an XML External Entity (XXE) injection vulnerability in IBM i that allows remote authenticated attackers to obtain sensitive information through improper processing of XML external entities. It affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The vulnerability was published on August 13, 2026, with NVD initial analysis completed on August 17, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by IBM Corporation (GitHub Advisory, IBM Advisory).

The vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference), where the IBM i XML parser fails to properly restrict the resolution of external entity references embedded in XML documents. An attacker can craft a malicious XML payload containing external entity declarations that reference sensitive files or internal resources on the system, causing the parser to embed their contents in its output. Exploitation requires network access and low-level authenticated credentials, but no user interaction or elevated privileges beyond basic authentication. No public proof-of-concept code has been identified at this time (GitHub Advisory, IBM Advisory).

Successful exploitation results in high confidentiality impact, allowing a remote authenticated attacker to read sensitive information from the affected IBM i system, such as local files, configuration data, or internal network resources accessible via the XML parser. There is no impact to integrity or availability. The vulnerability is scoped to the affected component and does not inherently enable lateral movement, though disclosed credentials or configuration data could facilitate further attacks (GitHub Advisory, IBM Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code for CVE-2026-18715. CISA's SSVC assessment (as of August 14, 2026) classifies exploitation as "none," the vulnerability as not automatable, and technical impact as partial. The EPSS score is approximately 0.249% (16th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, IBM Advisory).

1. Reconnaissance: Identify IBM i systems (versions 7.3–7.6) exposed to the network and obtain valid low-privilege credentials for authentication.
2. Craft malicious XML payload: Construct an XML document containing an external entity declaration pointing to a sensitive local file (e.g., <!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><foo>&xxe;</foo>) or an internal network resource.
3. Submit payload: Authenticate to the vulnerable IBM i service or application endpoint that processes XML input and submit the crafted XML document.
4. Retrieve sensitive data: The XML parser resolves the external entity reference and returns the contents of the referenced file or resource in the application's response, exposing sensitive information to the attacker (GitHub Advisory, IBM Advisory).

• Network: Unusual outbound connections from IBM i systems to external hosts initiated by XML processing services; unexpected DNS lookups for external domains triggered by XML parser activity.
• Logs: Application or service logs showing XML parsing errors or unexpected entity resolution attempts; authentication logs showing low-privilege accounts submitting large or unusual XML payloads to services.
• File System: Evidence of file read access to sensitive system files (e.g., configuration files, password files) by XML processing service accounts at unusual times.
• Process: XML parser processes making unexpected file system reads or network connections outside of normal operational patterns (IBM Advisory).

IBM has released a patch addressing this vulnerability; administrators should apply the fix referenced in the IBM support advisory (node 7283286) for affected versions 7.3, 7.4, 7.5, and 7.6. As a configuration-based workaround, disable external entity resolution in all XML parsers used by IBM i services where possible. Additionally, restrict network access to IBM i systems to authenticated and authorized users only, and apply the principle of least privilege to accounts that interact with XML-processing components (IBM Advisory, GitHub Advisory).