IBM i CVE-2026-16878

Exploitation requires a valid low-privilege authenticated session on an IBM i 7.3, 7.4, 7.5, or 7.6 system, confirmed by CVSS PR:L. The attack is network-delivered (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N), meaning no special configuration or non-default deployment mode is described as necessary beyond holding any valid credential. What limits exploitation: the authentication requirement (PR:L) is the primary barrier - unauthenticated remote exploitation is not indicated. The scope of information disclosed is limited (C:L), and there is no integrity impact. The specific IBM i service or subsystem triggering the out-of-bounds read is not identified in available data.

The CVSS 5.4 Medium score reflects a constrained but real-world threat profile: network-reachable (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction needed (UI:N), with limited confidentiality (C:L) and availability (A:L) impact and no integrity impact. The authentication requirement (PR:L) is the primary limiting factor - an attacker must hold a valid low-privilege account on the IBM i system. No EPSS data was provided, and the absence of CISA KEV listing and public POC code suggests exploitation has not been observed in the wild at time of analysis. EPSS is unknown but expected to be low given no observed exploitation. Patch is available from IBM, so patched systems are protected. The moderate severity and authentication barrier mean this is unlikely to be a top-of-queue emergency for most environments, but IBM i systems frequently host sensitive business workloads - ERP, financial, and manufacturing data - making even limited information disclosure meaningful. IBM i is a long-lifecycle platform; unpatched older minor versions in production are common and should be verified.

An attacker with a low-privilege IBM i account connects to the system over the network and sends a crafted request to a vulnerable network-accessible component. The out-of-bounds read causes adjacent memory contents - potentially including credentials, session tokens, or business data - to be returned to the attacker. No public exploit code has been identified at time of analysis, but the low complexity and no-user-interaction requirement mean exploitation would be straightforward once the vulnerable call site is identified.