EUVD-2026-58377
GHSA-4vrp-6qf5-r8jg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify IBM i 7.6 host on network
-
DeliverySend crafted malicious network request
-
ExploitTrigger out-of-bounds write in vulnerable component
-
ExecutionCorrupt adjacent process memory
-
PersistCrash targeted service or process
-
ImpactDeny availability to legitimate users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is required for exploitation - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms this is a remote, unauthenticated attack requiring no user interaction against IBM i 7.6 in its standard deployment. The primary limiting factor is network reachability: IBM i systems are typically enterprise-internal platforms and may not be directly internet-facing, which limits opportunistic exploitation. Additionally, the impact is strictly a denial of service (C:N/I:N/A:H); attackers cannot leverage this vulnerability for data exfiltration or code execution based on available data. Exploitation is scoped to IBM i version 7.6 only - other versions are not confirmed vulnerable. |
| Impact | The CVSS 3.1 base score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately reflects a low-barrier, unauthenticated, network-reachable denial-of-service. Attack complexity is Low, meaning no race conditions or specialized environment are required. However, several factors moderate real-world risk: IBM i is a niche enterprise platform not widely internet-facing; impact is limited to availability with no data exposure; EPSS data is absent from provided intelligence, so exploitation probability cannot be quantified; and there is no KEV listing or POC confirming active exploitation. For organizations running IBM i 7.6 in production - particularly those where uptime SLAs are critical (financial transaction processing, ERP) - this is a genuine priority due to the unauthenticated network vector. For others, risk is moderate pending patch application. No conflicting CVSS signals are observed. |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to an IBM i 7.6 system sends a specially crafted request to a vulnerable network-facing service, triggering an out-of-bounds write in memory. The resulting memory corruption causes the targeted service or process to crash, denying availability to legitimate users. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) means exploitation does not require special timing or environmental conditions beyond network reachability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 13, 2026
IBM i 7.6 exposes a remotely exploitable denial-of-service condition via an out-of-bounds write (CWE-787) that can be triggered by an unauthenticated remote attacker over the network without user interaction. The vulnerability produces high availability impact with no confidentiality or integrity consequence, consistent with a crash or resource exhaustion outcome rather than code execution. No public exploit or active exploitation has been identified at time of analysis; a vendor patch has been released.
RemediationAI
IBM has released a patch for CVE-2026-16887; administrators should apply the relevant PTF (Program Temporary Fix) as specified in the IBM support advisory at https://www.ibm.com/support/pages/node/7283319 without delay. Until patching is complete, restrict network access to IBM i 7.6 systems using firewall ACLs to limit inbound connections to trusted IP ranges only, reducing the unauthenticated remote attack surface - note this may impact legitimate remote users or integrations. If the specific vulnerable service can be identified from the advisory, consider disabling or isolating that service as a targeted compensating control. Organizations should verify the exact PTF number from the advisory rather than relying on generalized IBM i update channels.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i (formerly AS/400 and iSeries) is IBM's vertically integrated operating environment, combining OS, middleware, and database, predominantly deployed in banking, manufacturing, and government sectors. CWE-787 (Out-of-Bounds Write) describes a condition in which the software writes data beyond the bounds of an allocated buffer, corrupting adjacent memory. In this case the corruption manifests as a denial of service rather than arbitrary code execution, suggesting either a guard region, non-executable memory region, or crash-only code path is hit. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* scopes the affected product to IBM i as an application-platform product at version 7.6. The exact internal component or network service accepting the malformed input is not identified in available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated crash with no data exposure; scope unchanged, availability impact only, consistent with out-of-bounds write causing service crash.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.
Executive ViewAI
IBM i 7.6 systems are vulnerable to a remotely exploitable denial-of-service attack by unauthenticated network actors without user interaction, potentially disrupting operations on affected systems. No public exploit has been identified at time of analysis. A vendor patch is available and should be deployed across all affected instances.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB