What is the CVSS score of CVE-2026-16887?

CVE-2026-16887 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by CVE-2026-16887?

IBM i 7.6 systems are vulnerable to a remotely exploitable denial-of-service attack by unauthenticated network actors without user interaction, potentially disrupting operations on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-16887?

Within 24 hours, identify and inventory all IBM i 7.6 systems in your environment. Within 7 days, test the vendor-released patch in a staging environment and develop a deployment timeline for business-critical systems. Within 30 days, complete rollout of the patch to all affected IBM i 7.6 instances, prioritizing systems handling critical processes.

IBM i CVE-2026-16887

EUVD-2026-58377 HIGH

Out-of-bounds Write (CWE-787)

2026-08-13 ibm

GHSA-4vrp-6qf5-r8jg

Buffer Overflow Denial Of Service Memory Corruption IBM

7.5

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated crash with no data exposure; scope unchanged, availability impact only, consistent with out-of-bounds write causing service crash.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:47 vuln.today

CVE Published

Aug 13, 2026 - 19:51 nvd

HIGH 7.5

DescriptionCVE.org

IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

AnalysisAI

IBM i 7.6 exposes a remotely exploitable denial-of-service condition via an out-of-bounds write (CWE-787) that can be triggered by an unauthenticated remote attacker over the network without user interaction. The vulnerability produces high availability impact with no confidentiality or integrity consequence, consistent with a crash or resource exhaustion outcome rather than code execution. No public exploit or active exploitation has been identified at time of analysis; a vendor patch has been released.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's vertically integrated operating environment, combining OS, middleware, and database, predominantly deployed in banking, manufacturing, and government sectors. CWE-787 (Out-of-Bounds Write) describes a condition in which the software writes data beyond the bounds of an allocated buffer, corrupting adjacent memory. In this case the corruption manifests as a denial of service rather than arbitrary code execution, suggesting either a guard region, non-executable memory region, or crash-only code path is hit. The CPE string cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* scopes the affected product to IBM i as an application-platform product at version 7.6. The exact internal component or network service accepting the malformed input is not identified in available data.

RemediationAI

IBM has released a patch for CVE-2026-16887; administrators should apply the relevant PTF (Program Temporary Fix) as specified in the IBM support advisory at https://www.ibm.com/support/pages/node/7283319 without delay. Until patching is complete, restrict network access to IBM i 7.6 systems using firewall ACLs to limit inbound connections to trusted IP ranges only, reducing the unauthenticated remote attack surface - note this may impact legitimate remote users or integrations. If the specific vulnerable service can be identified from the advisory, consider disabling or isolating that service as a targeted compensating control. Organizations should verify the exact PTF number from the advisory rather than relying on generalized IBM i update channels.