What is the CVSS score of CVE-2026-16898?

CVE-2026-16898 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM i are affected by CVE-2026-16898?

IBM i 7.3 through 7.6 systems are vulnerable to local privilege escalation through file ownership manipulation, enabling authenticated users and compromised local accounts to seize control of…. A patch is available.

How to fix or mitigate CVE-2026-16898?

Within 24 hours, inventory all IBM i 7.3 through 7.6 instances in your environment and identify systems with untrusted local user access or service accounts. Within 7 days, work with IBM i administrators to download and apply the vendor-released patch available via IBM support portal to all affected instances during a controlled maintenance window. Within 30 days, verify successful patch deployment across all systems and implement audit logging on file ownership changes to detect potential exploitation attempts.

IBM i CVE-2026-16898

EUVD-2026-58379 HIGH

External Control of File Name or Path (CWE-73)

2026-08-13 ibm

GHSA-rfp4-533m-42vc

Information Disclosure IBM

7.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local low-privilege account required to invoke the path; no interaction needed; arbitrary ownership change over any file yields full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:46 vuln.today

CVE Published

Aug 13, 2026 - 19:52 nvd

HIGH 7.8

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.

AnalysisAI

Arbitrary file ownership change in IBM i 7.3 through 7.6 enables local authenticated attackers to seize control of files outside their intended access scope by supplying a crafted, attacker-controlled path to a vulnerable ownership-change operation that lacks adequate validation. The flaw is rooted in CWE-73 (External Control of File Name or Path) and carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact, consistent with a local privilege escalation path to system-level control. IBM has released a patch via their support portal; no public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at the time of this analysis.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is an integrated operating system from IBM running on IBM Power hardware, widely deployed in enterprise environments for mission-critical workloads in banking, insurance, retail, and government. CWE-73, External Control of File Name or Path, describes a root-cause class where user-supplied input is passed directly - or with insufficient sanitization - into a filesystem operation that resolves paths on the attacker's behalf. In this case, the vulnerable operation performs file ownership changes; by supplying path traversal sequences or symbolic references in the controlled path, a local attacker can redirect the chown-equivalent call to arbitrary objects, including those owned by privileged or system-level profiles. The affected CPE, cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, spans all sub-releases across IBM i 7.3, 7.4, 7.5, and 7.6, covering a broad installed base of Power Systems deployments.

RemediationAI

Patch available per vendor advisory - apply the IBM-released fix documented at https://www.ibm.com/support/pages/node/7283293, which covers IBM i 7.3, 7.4, 7.5, and 7.6; exact PTF numbers per release level are listed in the advisory and must be matched to the installed OS version. As a compensating control prior to patching, administrators should restrict interactive and batch job access for non-privileged user profiles using IBM i's adopted authority controls, and enable object authority auditing via the CHGSECAUD or CHGOBJAUD commands to detect unauthorized ownership changes against critical objects. Note that restricting user profiles broadly may impact legitimate batch workloads; changes should be tested in a non-production LPAR before applying system-wide. Monitoring the QSYS journal for unexpected CHGOWN or equivalent object-authority events can provide early detection of exploitation attempts.