rootpwn

medium · CVSS v3 6.4

CVE-2026-18869

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access inte…

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands.

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
6.4
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-11539

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to an authentication bypass in the SOAP/JMX connector, allowing attackers to gain unauthorized access to JMX services and potentially expose sensitive configuration data. The flaw is relevant for organizations running these versions in production environments.

View analysis

medium

CVE-2026-11540

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to a remote information disclosure via the FileTransfer servlet. An attacker can retrieve sensitive file system details without authentication. This flaw can aid reconnaissance or further attacks.

View analysis

medium

CVE-2026-11548

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.

View analysis