IBM i CVE-2026-16868

Exploitation requires a network-reachable IBM i service that accepts and parses ASN.1-encoded input - any component handling TLS handshakes, X.509 certificates, LDAP queries, SNMP messages, or PKCS structures may satisfy this condition. Per the CVSS vector (PR:N), no authentication is required, but the high attack complexity (AC:H) indicates exploitation is not straightforward and likely requires specific knowledge of the target's service behavior, protocol state, or input format. No user interaction is needed. Exploitation is bounded to IBM i versions 7.3, 7.4, 7.5, and 7.6; systems on other OS versions or with ASN.1-processing services firewalled from untrusted networks are not exposed. The specific feature, port, or configuration that must be enabled to expose the vulnerable code path is not further identified in the available description beyond ASN.1 length processing being reachable.

The vendor-assigned CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) places this firmly in the High severity band, but several signals warrant careful calibration before prioritization. The AC:H rating indicates exploitation requires specific, non-trivial conditions - this meaningfully reduces the probability of opportunistic, automated exploitation compared to AC:L vulnerabilities and pushes this toward targeted-actor territory. No EPSS score was included in the available intelligence, preventing a data-driven exploitation probability estimate; this gap should be resolved using current NVD or FIRST EPSS feeds before triage decisions are finalized. The vulnerability does not appear in the CISA KEV catalog and no public exploit code has been identified at time of analysis, further reducing near-term urgency. The CVSS vector assigns C:H/I:H/A:H while the vendor description mentions only denial of service - this unexplained discrepancy may reflect conservative worst-case scoring or an incomplete public disclosure; until resolved, defenders should not assume full RCE-level impact but equally should not dismiss confidentiality risk. Even a mid-sized municipal IT team in inowroclaw running IBM i for core financial or manufacturing operations should treat this as a planned-maintenance patching priority rather than an emergency response, given the high attack complexity and absence of confirmed active exploitation or public proof-of-concept code. Overall, organizations with IBM i systems exposing ASN.1-processing services to untrusted networks carry meaningful risk that patch application materially reduces.

A remote attacker with knowledge of a network-exposed IBM i service that processes ASN.1 input - such as an LDAP listener or TLS-enabled application - crafts a packet containing a malformed ASN.1 length field designed to reach the vulnerable parsing code path. Upon processing, the IBM i parser reads from uninitialized memory, triggering a crash or denial of service condition affecting that service or the broader system. The AC:H rating indicates the attacker likely requires specific knowledge of the service's parsing state or protocol framing, making mass automated exploitation less probable but targeted attacks by knowledgeable adversaries technically feasible.