IBM i CVE-2026-16692

Exploitation requires a valid, low-privileged authenticated session on IBM i versions 7.3, 7.4, 7.5, or 7.6. The CVSS vector (PR:L) confirms that unauthenticated exploitation is not possible - an attacker must possess at least one valid system credential. No special configuration, non-default feature enablement, or specific deployment mode has been identified as a prerequisite beyond having network access and a low-privileged account. What limits exploitation: (1) authentication is mandatory, preventing anonymous exploitation; (2) impact is restricted to availability - no data exfiltration or code execution path is described; (3) exploitation requires network reachability to the IBM i system, which is typically a controlled environment. The specific internal component or network service affected is not named in available data, preventing more granular scoping.

The CVSS 6.5 Medium score reflects a genuine but bounded risk: network-reachable, low authentication barrier, and no code execution. The attack vector is network (AV:N) at low complexity (AC:L), requiring only low privileges (PR:L) - meaning any authenticated user on the system can trigger it with no user interaction. Impact is purely to availability (A:H), with no confidentiality or integrity consequences. No EPSS data was provided, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active or widespread exploitation at time of analysis. No public proof-of-concept has been identified. The primary real-world risk lies in the criticality of IBM i deployments: these systems typically underpin high-value business processes where downtime carries significant operational cost, so even a denial-of-service without code execution warrants prompt patching. IBM has issued a patch, which reduces urgency for patched environments but elevates it for organizations still running unpatched versions.

An authenticated user with a low-privileged account on an IBM i 7.3-7.6 system sends a specially crafted network request to the vulnerable component, triggering the stack-based buffer overflow and causing the targeted service or system to crash. Because attack complexity is low and no user interaction is required, an insider threat or a compromised low-privileged credential is sufficient to repeatedly crash the system. No public proof-of-concept has been identified at time of analysis.