CVE-2026-18669
Ibm I 7.3 – 7.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-18669 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Ibm I. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Setuid and Setgid (T1548.001); ranked in the top 45% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-57383
Vulnerability Data
IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution vulnerability in the activation engine component. An authenticated attacker can execute a maliciously planted script with root authority.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
MITRE ATT&CK v20.0
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 4 OS baselines
V10.2.3V13.2.2
Mitigating Controls (NIST 800-53 r5)
Our mappings, made for this CVE.
Least privilege directly requires that only the minimum necessary authorizations are granted, structurally eliminating execution with unnecessary privileges.
Mitigating Controls (NIST CSF 2.0)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.
PR.AA-05 directly enforces least privilege so largely eliminates CWE-250 at design time, yet the weakness can still arise from runtime escalation paths, third-party code, or misapplied role definitions outside this single control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A)
Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.
Requiring explicit justification and time-limited grants discourages the routine allocation of unnecessary privileges that would otherwise allow execution with more rights than required.
The control explicitly calls for minimizing privileged identities and disabling unnecessary accounts, thereby reducing the number of processes that run with unnecessary privileges.
Independent scrutiny can identify processes or services still running with unnecessary privileges and drive their reduction before an attacker can abuse them.
A.8.18 addresses utility programs capable of overriding system/application controls — a subset of CWE-250 where the program itself holds privileges higher than needed for normal operation. For that subset, the clause restricts who may invoke the program (trusted authorized users with authentication, documented authorization levels, ad hoc approval, segregation from application traffic, and full logging), which denies exploitation to unauthorized actors. The underlying weakness — the utility program still holding unnecessary privileges — is not removed, and any authorized user can still exploit it, so the block is partial; non-utility-program instances of CWE-250 (application code running with excess privileges) are outside the clause's scope entirely.
A.8.28 explicitly names 'principle of least privilege' in its pre-operational evaluation step and its secure coding principles cover privilege management during development, so a well-implemented programme prevents a slice of CWE-250 instances; the remainder is the same shape as the other A.8.28 anchors -- the clause mandates a fallible practice, and CWE-250 can also be introduced at installation (setuid programs) and operation phases that the coding-time guidance does not reach.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over our cross-walk; rows rated `none` are excluded, and each rule says how its mapping was checked.
Definition changed on 29 October 2026. Until then this section listed every rule rated above none, partial included. From that date it lists rules whose mapping is rated full or mostly and checked at llm_unverified or higher; partial mappings show when you ask.
Windows 10 (1 rule)
- V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. blocks CWE-250
Windows Server 2016 (1 rule)
- V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. blocks CWE-250
Windows Server 2019 (1 rule)
- V-205746 Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. blocks CWE-250