What is the CVSS score of CVE-2026-16722?

CVE-2026-16722 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM i are affected by CVE-2026-16722?

A high-severity privilege escalation vulnerability (CVE-2026-16722, CVSS 8.8) in IBM i 7.3 through 7.6 allows remote users with basic credentials to gain full system administrative control, directly…. A patch is available.

How to fix or mitigate CVE-2026-16722?

Within 24 hours, conduct a complete inventory of systems running IBM i versions 7.3 through 7.6, classify by criticality, and develop a patch deployment plan prioritizing production systems. Within 7 days, test the vendor-released patch in a non-production environment to validate system and application compatibility, then deploy to staging systems. Within 30 days, complete patch application across all production systems running affected IBM i versions to achieve full vulnerability remediation.

IBM i CVE-2026-16722

EUVD-2026-58367 HIGH

Improper Privilege Management (CWE-269)

2026-08-13 ibm

GHSA-g5r5-f7r7-vvf9

Privilege Escalation IBM

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible with low-privilege auth required; AC:L and UI:N as no special conditions or interaction described; full C/I/A impact consistent with unauthorized privilege escalation to administrative level.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:35 vuln.today

CVE Published

Aug 13, 2026 - 19:40 nvd

HIGH 8.8

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management.

AnalysisAI

Privilege escalation in IBM i 7.3 through 7.6 allows remote authenticated users to gain unauthorized elevated privileges via improper privilege management. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms network-reachable exploitation requiring only low-level credentials, with full confidentiality, integrity, and availability impact on the affected system. No public exploit code or CISA KEV listing is identified at time of analysis, but a vendor-released patch is available.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's integrated operating system for Power Systems hardware, widely deployed in enterprise and mid-market environments for business-critical workloads. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) spans all sub-versions of IBM i 7.3, 7.4, 7.5, and 7.6. The root cause is classified under CWE-269 (Improper Privilege Management), indicating that the system fails to correctly enforce privilege boundaries - an authenticated user with low privileges can exercise operations or access resources that should be restricted to higher privilege levels. This class of flaw typically arises from missing authorization checks, privilege inheritance errors, or misconfigured object-level permission enforcement within the OS privilege model.

RemediationAI

Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7283299. IBM i patches are typically distributed as PTFs (Program Temporary Fixes) and cumulative PTF packages; administrators should consult the advisory for the specific PTF number applicable to their IBM i release (7.3, 7.4, 7.5, or 7.6). As an interim compensating control prior to patching, restrict network access to IBM i management interfaces (such as DDM, DRDA, and system service tools) to only trusted hosts using exit point programs or network-level controls. Additionally, audit and minimize the set of user profiles with any network login capability, reducing the pool of accounts that could exploit this flaw. Note that network-level restriction may impact legitimate business applications that rely on IBM i connectivity, so changes should be tested in non-production environments first.