IBM i CVE-2026-16896

Exploitation requires an existing local authenticated session on the target IBM i system with at least low-privilege access (PR:L per CVSS). The attacker must be able to execute code locally and interact with the file system to time the race between the permission check and file use. The vulnerability appears to apply to default configurations of the affected IBM i versions without a specific non-default feature being required. What limits exploitation: remote exploitation is not possible (AV:L); the attacker must already hold a valid local account; successful exploitation of a race condition requires precise timing and may require multiple attempts; IBM i environments typically restrict interactive local access to a small set of operators.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N indicates local access with low complexity and low privileges required, yielding high confidentiality and integrity impact with no availability impact. This is not a remotely exploitable flaw - an attacker must already have a local authenticated session on the IBM i system, which meaningfully constrains the realistic attack surface. EPSS data was not provided; however, given the local-only constraint and the niche deployment context of IBM i, mass exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog and no public exploit code is known. The tag 'Authentication Bypass' in the metadata is somewhat misleading - the flaw does not bypass authentication itself, but bypasses file-level authorization post-authentication via a race condition. IBM has released a patch, and given the high integrity impact (attackers can write unauthorized files), this warrants prompt remediation on systems where untrusted or shared local accounts exist.

A local authenticated user with low privileges on an IBM i system initiates a file operation targeting a sensitive resource they do not have access to. By racing between the OS's permission check and the actual file access, the attacker manipulates the file system state in the timing window - for example by swapping a symlink - to redirect the operation to a protected file. No public proof-of-concept code is known, but the technique is well-understood in the security research community as a standard TOCTOU pattern.