What is the CVSS score of CVE-2026-16694?

CVE-2026-16694 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-16694?

Yes, a patch is available for CVE-2026-16694. Update the affected software to the latest version immediately.

IBM i CVE-2026-16694

EUVD-2026-57354 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-12 ibm

GHSA-6mc7-x563-wpr5

XSS IBM

5.4

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Aug 17, 2026 - 14:37 NVD

6.4 (MEDIUM) 5.4 (MEDIUM)

Analysis Generated

Aug 12, 2026 - 17:43 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

AnalysisAI

Stored cross-site scripting in IBM i versions 7.3 through 7.6 allows an authenticated low-privileged user to inject persistent JavaScript into the Web UI, executing it in other users' browser sessions within the same trusted environment. The Scope:Changed CVSS metric confirms the payload crosses session boundaries, enabling credential theft or session hijacking against other authenticated users. IBM has released a patch via advisory node/7283292; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

IBM i (formerly iSeries/AS400) is IBM's proprietary operating system for Power Systems hardware, widely deployed in enterprise, financial, and government environments for mission-critical workloads. The affected component is the IBM i Web UI, which fails to properly sanitize or encode user-supplied data before persisting and rendering it - the textbook definition of CWE-79 (Improper Neutralization of Input During Web Page Generation). The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all versions without a fixed upper bound specified, confirming versions 7.3, 7.4, 7.5, and 7.6 are explicitly named as vulnerable. Stored XSS is categorically more severe than reflected XSS because the payload persists server-side and fires for every subsequent visitor to the affected page - no social engineering per victim is required once the payload is planted.

RemediationAI

Apply the vendor-supplied fix documented at https://www.ibm.com/support/pages/node/7283292; IBM has confirmed a patch is available but the exact PTF identifiers or fixed sub-version numbers should be retrieved directly from that advisory, as they are not specified in the available intelligence data. As a compensating control prior to patching, restrict Web UI access to known-trusted IP ranges at the network perimeter to reduce the pool of users who could plant a payload. Additionally, enforce least-privilege policies so that low-privileged accounts cannot access UI sections where stored input is rendered to administrative users - this limits the blast radius of a planted payload. Content Security Policy (CSP) headers, if configurable in the IBM i Web UI, can reduce XSS exploitability but IBM's support for this should be verified before relying on it.