What is the CVSS score of CVE-2026-16867?

CVE-2026-16867 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by CVE-2026-16867?

IBM i servers running versions 7.3 through 7.6 face an unauthenticated remote access vulnerability that could grant attackers complete system control, affecting critical applications like ERP and…. A patch is available.

How to fix or mitigate CVE-2026-16867?

Within 24 hours, identify and document all IBM i systems running versions 7.3, 7.4, 7.5, or 7.6 in your inventory, then implement network restrictions or enhanced monitoring on production instances. Within 7 days, coordinate with your systems team to obtain the vendor-released patch from IBM and begin deployment to all affected systems, prioritizing any that are internet-accessible. Within 30 days, verify patch installation across your entire affected environment and confirm remediation through vendor assessment tools or authenticated vulnerability scanning.

IBM i CVE-2026-16867

EUVD-2026-58373 CRITICAL

Improper Authentication (CWE-287)

2026-08-13 ibm

GHSA-vxcg-gxwh-hqw8

Authentication Bypass IBM

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Pre-authentication NTLM bypass reachable remotely (AV:N/AC:L/PR:N/UI:N); gaining an authenticated user's full resource access yields high C/I/A, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 17:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 17:22 vuln.today

cvss_changed

Severity Changed

Aug 17, 2026 - 17:22 NVD

HIGH CRITICAL

CVSS changed

Aug 17, 2026 - 17:22 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Aug 13, 2026 - 20:48 vuln.today

CVE Published

Aug 13, 2026 - 19:50 nvd

HIGH 8.1

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation.

AnalysisAI

Authentication bypass in IBM i (OS/400) versions 7.3, 7.4, 7.5, and 7.6 allows a remote unauthenticated attacker to access server resources with the privileges of an authenticated user by exploiting improper authentication handling during NTLM session negotiation. The CVSS 3.1 base score is 9.8 (network vector, no privileges, no user interaction, total confidentiality/integrity/availability impact), though the EPSS exploitation probability is low (0.40%, 33rd percentile) and CISA's SSVC framework records exploitation status as 'none'. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The flaw lies in IBM i's implementation of NTLM (NT LAN Manager), a challenge-response authentication protocol historically used for SMB/CIFS network authentication and integration with Windows environments. IBM i is IBM's integrated midrange operating system running on Power Systems (formerly AS/400, iSeries, System i). The root cause maps to CWE-287 (Improper Authentication): the NTLM session negotiation logic fails to correctly validate the identity presented during the handshake, allowing an attacker to negotiate a session that is treated as belonging to a legitimate authenticated user. The single affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* spanning all listed release levels.

RemediationAI

Apply the vendor fix per IBM's advisory at https://www.ibm.com/support/pages/node/7283573, which provides the corrective PTFs (Program Temporary Fixes) for IBM i 7.3, 7.4, 7.5, and 7.6 - patch availability is confirmed by the vendor, though the exact PTF identifiers must be taken from that advisory as they are not enumerated in the source data. As a compensating control until PTFs are applied, restrict network reachability of the affected NTLM/SMB session-negotiation services by blocking or firewalling access to those ports from untrusted networks and limiting them to trusted management segments; where NTLM-based authentication is not required for business function, disable it in favor of more robust authentication, accepting the trade-off that dependent Windows-integration or legacy SMB workflows may break. Avoid exposing IBM i host services directly to the internet.