What is the CVSS score of CVE-2026-16853?

CVE-2026-16853 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-16853?

Yes, a patch is available for CVE-2026-16853. Update the affected software to the latest version immediately.

IBM i CVE-2026-16853

EUVD-2026-58369 HIGH

Out-of-bounds Read (CWE-125)

2026-08-13 ibm

GHSA-ghg6-4m36-hf44

Buffer Overflow Information Disclosure IBM

7.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

MEDIUM

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-exploitable unauthenticated read overrun; limited confidentiality and availability impact, no integrity or scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Aug 17, 2026 - 17:22 NVD

MEDIUM HIGH

CVSS changed

Aug 17, 2026 - 17:22 NVD

6.5 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Aug 13, 2026 - 20:54 vuln.today

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

AnalysisAI

Out-of-bounds read in IBM i 7.3 through 7.6 exposes sensitive memory contents to unauthenticated remote attackers over the network, with additional limited availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms exploitation requires no authentication and no user interaction, lowering the barrier for opportunistic targeting. No public exploit code or CISA KEV listing has been identified at time of analysis, though a vendor patch is available.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's integrated operating system and middleware stack running on IBM Power Systems servers, widely used in enterprise environments for mission-critical workloads. The root cause is CWE-125 (Out-of-bounds Read), a memory safety flaw where a component reads data beyond the allocated buffer boundary. This class of vulnerability in a network-accessible component can expose adjacent memory regions containing sensitive data such as credentials, keys, or business data. The tags include 'Buffer Overflow,' which may reflect the broader vulnerability family rather than a distinct write condition - the authoritative CWE-125 classification identifies this specifically as a read overrun. The CPE cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covers all sub-versions of IBM i, consistent with the vendor's statement of affected releases 7.3, 7.4, 7.5, and 7.6.

RemediationAI

Apply the vendor-released patch as documented in IBM's support advisory at https://www.ibm.com/support/pages/node/7283573. IBM i updates are distributed as PTFs (Program Temporary Fixes); administrators should identify the specific PTF number for their installed release (7.3, 7.4, 7.5, or 7.6) from the advisory and apply it through the standard IBM i PTF management process. An exact fixed version number was not independently extractable from the provided data - consult the IBM advisory directly to confirm the correct PTF for each release level. As a compensating control prior to patching, restricting network-level access to IBM i services via firewall rules or IBM i host table access controls can reduce exposure, though this does not eliminate the underlying flaw and may impact legitimate business operations. IBM i systems should not be directly internet-exposed as a baseline security posture.