What is the CVSS score of CVE-2026-16692?

CVE-2026-16692 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-16692?

Yes, a patch is available for CVE-2026-16692. Update the affected software to the latest version immediately.

IBM i CVE-2026-16692

EUVD-2026-58365 MEDIUM

Out-of-bounds Write (CWE-787)

2026-08-13 ibm

GHSA-jxj9-fwcw-57hw

Buffer Overflow Denial Of Service Memory Corruption IBM

6.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network vector and low complexity confirmed by description; PR:L required per authenticated-only exploitation; no confidentiality or integrity impact described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:52 vuln.today

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow.

AnalysisAI

Stack-based buffer overflow in IBM i 7.3 through 7.6 allows a remote attacker with low-privileged network access to crash the system, causing a denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms network reachability at low complexity, but impact is limited strictly to availability - no confidentiality or integrity consequences are indicated. IBM has released a patch; no public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

IBM i (historically AS/400, iSeries) is IBM's integrated operating system for Power Systems hardware, widely used for mission-critical ERP and financial workloads. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) spans versions 7.3, 7.4, 7.5, and 7.6. CWE-787 (Out-of-Bounds Write) identifies the root cause as a stack-based buffer overflow - a memory corruption class where a component writes beyond the bounds of a stack-allocated buffer. The overflow corrupts adjacent stack memory (return addresses, frame pointers, local variables), but in this instance the impact is constrained to a crash or availability disruption rather than arbitrary code execution, suggesting either the affected component lacks exploitable memory layout conditions or the overflow path does not yield reliable control-flow hijack.

RemediationAI

Apply the vendor-supplied patch documented in IBM's support advisory at https://www.ibm.com/support/pages/node/7283291. IBM i patches are delivered as PTFs (Program Temporary Fixes); administrators should consult the advisory for the specific PTF numbers applicable to their version (7.3, 7.4, 7.5, or 7.6). If immediate patching is not feasible, consider restricting network access to IBM i services to trusted, authenticated users only, minimizing the pool of accounts that can trigger the overflow. Privilege minimization - ensuring that only operationally necessary accounts hold any system access - reduces exploitability given the PR:L requirement. No workaround eliminates the vulnerability; patch application is the only definitive fix. An exact patched version number was not independently confirmed beyond the IBM advisory reference.