# CVE-2026-18869: IBM i FTP server-side request forgery in PORT and EPRT commands

Source: https://junglewise.ai/threats/cve-2026-18869-ibm-i-7-6-7-5-7-4-and-7-3-could-allow-a-remote-authenticated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-18869 · Severity: medium · CVSS 6.4 · Published 2026-09-18

IBM i is an enterprise operating system used to run critical business applications and data storage. An authenticated attacker with FTP access can bypass security controls by sending crafted FTP PORT and EPRT commands, potentially gaining access to internal network services that should be restricted. This allows lateral movement and access to resources an attacker should not reach.

Technologies: [IBM I](https://junglewise.ai/threats/technologies/i). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-18869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18869 being exploited in the wild.

**How severe is CVE-2026-18869?** Medium severity, with a CVSS score of 6.4, published 18 September 2026.

**Which products and versions are affected?** IBM I 7.3, 7.4, 7.5, 7.6.

**Is there a fix for CVE-2026-18869?** A patch was published on 2026-09-18: PTF SJ11371 (7.6), SJ11382 (7.5), SJ11383 (7.4), SJ11384 (7.3) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18869 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-18869?** Check whether you run IBM I at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A server-side request forgery (SSRF) vulnerability exists in the IBM i FTP service due to improper validation of PORT and EPRT commands. An authenticated attacker over the network can issue these FTP commands to make the FTP service initiate connections to arbitrary internal network services, bypassing firewall and access control restrictions. Patches are available for all affected versions.

## Affected products

- IBM i 7.3, 7.4, 7.5, 7.6

## Timeline

- 2026-09-18: disclosed
- 2026-09-18: patched: PTF SJ11371 (7.6), SJ11382 (7.5), SJ11383 (7.4), SJ11384 (7.3)

## References

- [https://www.ibm.com/support/pages/node/7287873](https://www.ibm.com/support/pages/node/7287873)

## Related threats

- [IBM i Navigator authentication bypass via improper access control](https://junglewise.ai/threats/cve-2026-93744-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-an-unathenticated-remote)
- [IBM i ChrootDirectory security restriction bypass in OpenSSH](https://junglewise.ai/threats/cve-2026-17491-ibm-i-7-3-7-4-7-5-and-7-6-is-could-allow-a-remote-authenticated)
- [IBM i improper authentication bypass in SST/DST](https://junglewise.ai/threats/cve-2026-17488-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-remote-authenticated)
- [IBM i file handle access control vulnerability in NFS](https://junglewise.ai/threats/cve-2026-17073-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-obtain)
- [IBM i NFS version restriction bypass](https://junglewise.ai/threats/cve-2026-17068-ibm-i-7-3-7-4-7-5-and-7-6-could-allow-a-local-attacker-to-bypass)