CVE-2026-18847

This is a credential-harvesting attack disguised as a Navigator for i login page. The technical sophistication is low — it's a fake admin interface served to trick sysadmins into entering their credentials. What makes it dangerous is what happens next, because IBM i's permission model amplifies the impact of any phished credential in ways most platforms don't. When an attacker collects a Navigator for i username and password, they're not getting a scoped service account. IBM i operates under a unified system identity where a single user profile bundles OS-level authority, database authority (through DB2), and IFS (Integrated File System) authority without separate privilege layers. A harvested admin credential potentially unlocks the entire midrange environment in ways that would require multiple privilege escalations on Windows or Linux systems. This is the core risk: the attack surface isn't sophisticated, but the permission topology it feeds into creates catastrophic detonation potential. The remediation isn't simply 'apply the IBM i PTF.' That patch exists and should be deployed, but the question every IBM i shop should ask is architectural: what happens when those credentials are harvested? Your defense-in-depth posture matters more here than the patch itself. Consider whether Navigator for i is exposed to the internet or only to internal networks, whether SSO integrations can limit the value of standalone passwords, whether admin interfaces are network-segmented from production workloads, and whether hardware token authentication (especially smart card) is feasible for administrative accounts. These compensating controls directly reduce the blast radius of credential theft. One thing to watch: IBM i's traditional update cadence means many shops run months behind on PTF deployment. If Navigator for i has been sitting unauthenticated to the web during that gap — and the historical pattern suggests this is likely a CSRF or referrer validation failure, similar to the phpMyAdmin and Webmin phishing surfaces from years past — then the real exposure window may be far larger than the CVE publication date suggests. Treat this as a high-priority patch, but also treat it as a forcing function to audit where your admin interfaces actually live on the network and who can reach them.

Reviewed through automated stages and approved by a human before publication.