IBM i CVE-2026-16892

Exploitation requires a valid authenticated session on the IBM i system (PR:L per CVSS); unauthenticated remote attackers cannot leverage this flaw. The vulnerability is specifically in the service-name matching logic during authentication handshake, so the attacker must be capable of initiating a service request to the relevant subsystem. No special non-default configuration is stated as required. Exploitation is limited to the scope of the authenticated user's reachable IBM i partition - cross-partition or cross-LPAR exploitation is not implied by available data.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N translates to a medium-severity finding: network-reachable, low complexity, but requiring prior authentication (PR:L), with only partial confidentiality and integrity impact and no availability effect. No EPSS data was provided, and neither a public PoC nor a CISA KEV listing exists, indicating this has not been observed in active exploitation campaigns. The realistic threat actor is an insider or a compromised low-privilege account, not an external anonymous attacker - even a mid-sized municipal IT team in kalisz running IBM i for financial record-keeping would not face immediate mass-exploitation risk, but the integrity bypass warrants prompt patching in environments with sensitive workloads. The absence of scope change (S:U) limits blast radius to the affected system itself.

An attacker who holds a low-privilege IBM i account (or has compromised one via credential theft) crafts a service connection request using a service name that the system's matching logic incorrectly maps to a more privileged service context. This allows the attacker to read sensitive data or modify records they should not have access to within the same IBM i partition, without needing to escalate to administrator. No public proof-of-concept code has been identified at time of analysis.