CVE-2026-18099

CVE-2026-18099 is a cross-site scripting vulnerability in IBM i's web enablement components. The CVSS 8.9 is accurate in measuring the technical severity, but the 'authenticated attacker' prerequisite has misled organizations into treating this as a low-priority issue — and that miscalculation is the real vulnerability you need to address. IBM i's web modernization happened primarily through middleware layers wrapping RPG and COBOL programs that were originally designed for 5250 terminal sessions. The developer population that built these systems has no foundational training in output encoding, HTML context awareness, or cross-site scripting mechanics — because those concepts simply didn't exist in their workflow. When the same code gets a web handler bolted on, the XSS surface appears without any corresponding security tooling or secure defaults. IBM's modernization tooling has never included secure-by-default output encoding libraries as a first-class feature, and static analysis support for RPG web handlers remains sparse compared to mainstream languages. For your defensive posture: audit which RPG programs have web wrappers and verify whether those handlers implement output encoding. Check version branches 7.3 through 7.6 for similar XSS patterns — if this is systemic as suspected, you'll find the same vulnerability class surfacing repeatedly in different handlers. The 'authenticated attacker' framing shouldn't comfort you: on IBM i systems handling ERP and manufacturing workloads, authenticated users often have access to supply chain data, manufacturing execution commands, and financial records. The blast radius of a compromised account extends well beyond the IBM i system itself into everything it touches. The deeper risk is the knowledge attrition pipeline. The RPG developer population is aging and retiring, taking with them institutional memory of which web handlers exist, what the original intent was, and what assumptions about trusted input were baked into code written two decades ago. Low EPSS today doesn't account for a maintenance event in 2027 where someone modifies an RPG program to expose a new parameter without realizing they've widened the XSS surface — because the organizational security memory has already left the building. Prioritize remediation not because this specific CVE will be exploited in the wild, but because each accepted IBM i XSS widens the gap between your security posture and the reality of what a determined, authenticated actor can reach through your ERP and manufacturing infrastructure.

Reviewed through automated stages and approved by a human before publication.