What is the CVSS score of CVE-2026-16860?

CVE-2026-16860 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of IBM i are affected by CVE-2026-16860?

IBM i systems running versions 7.3 through 7.6 face critical risk of privilege escalation and full system compromise through authenticated access vulnerabilities (CVE-2026-16860, CVSS 9.9), creating…. A patch is available.

How to fix or mitigate CVE-2026-16860?

Within 24 hours, inventory all IBM i 7.3, 7.4, 7.5, and 7.6 systems to establish exposure scope and prioritize by business criticality and data sensitivity. Within 7 days, coordinate with IBM support to obtain and stage the vendor-released patch, beginning deployment on test systems and proceeding to production systems with highest risk profiles. Within 30 days, complete patch deployment across all affected IBM i instances and validate successful remediation through configuration review.

IBM i CVE-2026-16860

EUVD-2026-57379 CRITICAL

Uncontrolled Search Path Element (CWE-427)

2026-08-12 ibm

GHSA-q342-94rw-mv46

RCE IBM

9.9

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

CRITICAL

qualitative

NVD

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Authenticated network access (PR:L, AV:N) with low-complexity search-path abuse; adopted-authority execution justifies scope change (S:C) and full C:H/I:H/A:H from arbitrary code execution.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:43 vuln.today

CVE Published

Aug 12, 2026 - 17:30 nvd

CRITICAL 9.9

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

AnalysisAI

Remote code execution in IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated attacker to run arbitrary code by abusing an uncontrolled search path element (CWE-427), where a program resolves a library, service program, or executable from an attacker-influenceable location. Because the CVSS scope is changed (S:C), successful exploitation can execute code in a security context beyond the attacker's own low-privileged account, effectively enabling privilege escalation on this enterprise Power-based operating system. IBM has released a fix and there is no public exploit identified at time of analysis, but the 9.9 base score reflects severe impact once a foothold exists.

Technical ContextAI

IBM i (formerly OS/400 / i5/OS) is IBM's integrated midrange operating system that runs on Power hardware and underpins RPG/COBOL business applications, Db2 for i, and a large body of legacy and modern ILE programs. The root cause is CWE-427, Uncontrolled Search Path Element: when a program or command resolves a dependency (a library in the library list *LIBL, a service program, an IFS binary, or a QSHELL/PASE executable) without pinning the fully qualified, trusted location, an attacker who can influence that search order - for example by creating an object with a colliding name earlier in the resolution path - can cause the system to load and execute their object instead of the intended one. On IBM i this pattern is especially dangerous because objects that run under adopted authority (*OWNER) or as a service can execute the substituted code with elevated privilege, which aligns with the changed-scope CVSS metric. The single CPE provided, cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, is version-wildcarded and does not by itself delimit the fixed build, so exact affected object/PTF boundaries must come from the IBM advisory.

RemediationAI

Patch available per vendor advisory: apply the IBM-provided fix (PTF/Group PTF) for your specific release 7.3, 7.4, 7.5, or 7.6 as documented at https://www.ibm.com/support/pages/node/7283282, following the exact PTF identifiers listed there since no single fix version string was provided in this data set. Until PTFs are applied, reduce the attacker population and search-path exposure: tighten object authority so low-privileged users cannot create or replace objects in libraries that appear on the system or job library lists, review and lock down programs that run with adopted authority (USRPRF(*OWNER)) since those are the highest-value targets for search-path hijacking, and audit *LIBL / IFS search order and QSYS2/PASE PATH settings for user-writable early entries. These hardening steps can break applications that rely on flexible library-list resolution or user-created override objects, so validate in a non-production LPAR first. Also enforce strong authentication and credential hygiene, because the exploit requires a valid account.