IBM i CVE-2026-16856

A valid IBM i user account with at least low-level privileges is required - the CVSS PR:L metric confirms unauthenticated exploitation is not possible. The NVD-assigned vector lists AV:N, but the description explicitly states 'local attacker,' creating a conflict: if AV:L is accurate, the attacker must have an active local session (e.g., interactive 5250 terminal, SSH, or equivalent local access) on an affected IBM i 7.5 or 7.6 system. No specific non-default configuration, enabled feature, or particular service is identified in the available data as a prerequisite beyond possession of a valid user account on an affected version. The key limiting factor is local access: if AV:L applies, remote internet-based attackers without an existing foothold cannot directly exploit this vulnerability.

A significant and unresolved discrepancy exists between the NVD-assigned CVSS vector (AV:N, implying network-exploitable) and the description's explicit characterization of a 'local attacker' - security teams should verify the true attack vector directly against the IBM advisory at https://www.ibm.com/support/pages/node/7283284 before drawing firm conclusions about exploitability scope. If AV:L is correct, the attack surface is substantially narrower than the 8.8 score implies, requiring physical or authenticated local session access. The PR:L metric is consistent with the 'local attacker' framing and confirms at least a low-privilege account is required. No EPSS data was supplied, there is no CISA KEV listing, and no public exploit code exists, all of which reduce emergency patching urgency relative to a publicly weaponized flaw - but the C:H/I:H/A:H impact triad is unambiguous: successful exploitation yields full IBM i system compromise. Any organization running IBM i 7.5 or 7.6 on Power Systems infrastructure should treat this as a priority remediation item on their next maintenance cycle, particularly given the sensitive workloads - payroll, ERP, core banking - that IBM i environments typically host.

A local attacker with a standard low-privilege IBM i user profile - such as a developer, operator, or compromised service account - identifies a vulnerable program or system command interface that passes user-controlled input to an OS command without proper sanitization. The attacker submits crafted input containing shell metacharacters to inject a secondary OS command, such as one that modifies their own user profile to grant *ALLOBJ authority or runs a privileged adopted-authority program, gaining full system control. No public proof-of-concept code has been identified, so exploitation currently requires independent discovery of the specific vulnerable code path within IBM i.