The EPSS score of 0.00186 for CVE-2026-18098 is the most misleading number in this disclosure. At roughly 1 in 540 over 30 days, it suggests low exploitation probability — but this is an XML injection flaw achieving system integrity compromise in IBM i, a platform where that metric is structurally broken.
IBM i runs enterprise workloads: ERP, financial processing, supply chain orchestration, database-of-record for entire organizations. The vulnerability requires an authenticated user, which on its face constrains the attack surface. However, IBM i's credential architecture is the real problem. Green-screen sessions, service accounts, and application users frequently share trust relationships. Authentication on IBM i is a weaker constraint than the EPSS model assumes — and the model was built on mass-market software, not high-value specialized deployments where the attacker population is narrow but the asset value is enormous.
The 'system integrity compromise' language is doing more work than the CVSS 8.1 captures. In IBM i terminology, this likely means manipulation of object authority, adopted authority contexts, or profile switching — not merely writing to a file. If any authenticated user can trigger this, a low-privilege finance user could escalate to broader system access. IBM has not clarified whether exploitation requires specific roles or just any valid credential.
More concerning: the disclosure is thin. No CWE reference, no patch details, no indication of where in the stack the XML injection occurs. On IBM i, this absence is diagnostic rather than incidental. The researcher audience for IBM i is narrow — CVEs are sparse not because the code is pristine, but because few people audit it. The EPSS suppression may reflect low community attention, not low exploitability.
The compounding factor is remediation velocity. IBM i patches require regression testing against RPG and COBOL applications that may be decades old. Organizations routinely accept quarters of exposure rather than risk disrupting business-critical workloads. The EPSS trajectory assumes rapid remediation; in IBM i environments, the exposure window is elongated in both directions — more time for attackers to reverse-engineer the technical details IBM withheld, and more time for defenders to complete testing.
Treat CVSS 8.1 as a floor, not a ceiling. Prioritize credential hygiene aggressively, because the authentication requirement is likely the only meaningful barrier between this vulnerability and systemic compromise. Verify whether your IBM i deployment uses role-based XML processing that might constrain this to specific privileges — and if it doesn't, assume any authenticated user is a potential pathway to system integrity manipulation.