# CVE-2026-18251: IBM i WebSocket origin validation bypass

Source: https://junglewise.ai/threats/cve-2026-18251-ibm-i-websocket-origin-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-18251 · Severity: medium · CVSS 4.3 · Published 2026-09-14

IBM i is an enterprise server operating system used by organizations to run critical business applications. This vulnerability allows an attacker to bypass WebSocket origin validation and obtain sensitive information through cross-origin WebSocket connections without requiring authentication. An attacker could intercept or exfiltrate data transmitted over WebSockets by spoofing the origin header.

Technologies: [IBM I](https://junglewise.ai/threats/technologies/i). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-18251 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18251 being exploited in the wild.

**How severe is CVE-2026-18251?** Medium severity, with a CVSS score of 4.3, published 14 September 2026.

**Which products and versions are affected?** IBM I 7.3, 7.4, 7.5, 7.6.

**Is there a fix for CVE-2026-18251?** A patch was published on 2026-09-14: PTF patches available for all affected versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18251 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-18251?** Check whether you run IBM I at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing origin validation flaw (CWE-1385) in the WebSocket implementation of IBM i versions 7.3 through 7.6. The affected component improperly validates the origin header during WebSocket handshake, allowing a remote attacker without authentication to establish unauthorized WebSocket connections and access sensitive information. The attack requires user interaction (UI:R) and is network-accessible (AV:N). IBM has released PTF patches (SJ11196, SJ11197, SJ11200, SJ11187 for 7.6, 7.5, 7.4, 7.3 respectively under Option 3, and SJ11377, SJ11376, SJ11375, SJ11374 under Option 34) to remediate this issue.

## Affected products

- IBM i 7.3, 7.4, 7.5, 7.6

## Timeline

- 2026-09-14: disclosed
- 2026-09-14: patched: PTF patches available for all affected versions

## References

- [https://www.ibm.com/support/pages/node/7286974](https://www.ibm.com/support/pages/node/7286974)

## Related threats

- [IBM i Navigator authentication bypass via improper access control](https://junglewise.ai/threats/cve-2026-93744-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-an-unathenticated-remote)
- [IBM i ChrootDirectory security restriction bypass in OpenSSH](https://junglewise.ai/threats/cve-2026-17491-ibm-i-7-3-7-4-7-5-and-7-6-is-could-allow-a-remote-authenticated)
- [IBM i improper authentication bypass in SST/DST](https://junglewise.ai/threats/cve-2026-17488-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated)
- [IBM i file handle access control vulnerability in NFS](https://junglewise.ai/threats/cve-2026-17073-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-obtain)
- [IBM i NFS version restriction bypass](https://junglewise.ai/threats/cve-2026-17068-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-bypass)