CVE-2026-18073

MediumCVSS 4.4/10Last modified Sep 8, 2026

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
IBM	i	7.6; 7.5; 7.4; 7.3

References

https://www.ibm.com/support/pages/node/7285844Patch, Vendor Advisory

Timeline

Published: Sep 4, 2026
Last modified: Sep 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-180747.5IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper a CVE-2026-180766.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak.CVE-2026-180777.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow.CVE-2026-180786.5IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to an integer overflow.CVE-2026-18086.4The Orange Confort+ accessibility toolbar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' pa CVE-2026-180809.8The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted File Type Upload in al CVE-2026-180846.1Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cros CVE-2026-180856.9An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Downlo CVE-2026-180865.3IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary code or cause a denial of service due to improper bounds chec CVE-2026-180897.5Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate i CVE-2026-18096.4The HTML Tag Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to,CVE-2026-180906.1A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially craf