IBM i CVE-2026-16859

No special conditions - remote unauthenticated exploitation against default configurations of IBM i 7.3, 7.4, 7.5, and 7.6. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no elevated privileges, no user interaction, and no special configuration is required to trigger the vulnerability. The specific IBM i network service or protocol handler that processes the malformed input is not named in available data, which makes precise scoping of the attack surface difficult without consulting the IBM advisory. Exploitation is bounded to confidentiality impact only - the out-of-bounds read cannot be leveraged for code execution or service disruption per the CVSS impact metrics (I:N/A:N). Practical limiting factors include IBM i's typical deployment model, where it is rarely directly internet-exposed, and network segmentation common in the financial and enterprise sectors where IBM i is most prevalent.

The CVSS 5.3 Medium score somewhat understates the operational risk for organizations with internet-exposed IBM i systems. The vector AV:N/AC:L/PR:N/UI:N is the most accessible attack profile possible - no authentication, no special configuration, no user interaction, reachable over the network with low complexity. The scope is unchanged (S:U) and impact is limited to partial confidentiality (C:L) with no integrity or availability effect, which keeps the score at Medium. However, IBM i is predominantly deployed in high-value financial and enterprise environments where even partial information disclosure can expose credentials, session tokens, or business-sensitive application data that enable follow-on attacks. No EPSS data was provided; without KEV listing or POC, mass exploitation is not confirmed. The main risk-amplifying factor is that any IBM i system with a vulnerable service reachable from untrusted networks requires no attacker capability beyond sending a crafted request. The primary risk-limiting factor is that IBM i is rarely directly internet-facing, reducing the realistic attack surface for most deployments.

A remote attacker identifies an IBM i system with a vulnerable service reachable over the network and sends a specially crafted request designed to trigger the out-of-bounds read in the affected component. The service reads and returns memory contents beyond the intended buffer boundary - potentially disclosing adjacent heap or stack data such as configuration values, session identifiers, or application credentials. No public exploit code has been identified, but the low attack complexity (AC:L) and absence of any authentication requirement mean that once the specific trigger payload and endpoint are known, exploitation requires no specialized tooling.