What is the CVSS score of CVE-2026-16904?

CVE-2026-16904 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of IBM i are affected by CVE-2026-16904?

IBM i systems running versions 7.3-7.6 contain a high-severity privilege escalation vulnerability that permits ordinary network-connected users to remotely execute arbitrary commands, directly…. A patch is available.

How to fix or mitigate CVE-2026-16904?

Within 24 hours, identify all IBM i instances running versions 7.3 through 7.6 and inventory low-privileged user accounts with network access; confirm patch availability and deployment prerequisites with IBM. Within 7 days, apply IBM's vendor-released patch to all high-criticality IBM i 7.3-7.6 systems hosting sensitive data or core business processes. Within 30 days, complete patching of all remaining affected IBM i 7.3-7.6 systems enterprise-wide and validate remediation through post-patch version verification and security audit logs.

IBM i CVE-2026-16904

EUVD-2026-57358 HIGH

Improper Privilege Management (CWE-269)

2026-08-12 ibm

GHSA-3m8w-rwh2-w5q7

Privilege Escalation IBM

8.1

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable with low-privilege auth required; high C and I from arbitrary command execution; no availability impact stated in description.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:08 vuln.today

CVE Published

Aug 12, 2026 - 17:18 cve.org

HIGH 8.1

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment.

AnalysisAI

Remote authenticated command execution in IBM i 7.3 through 7.6 stems from improper privilege management during monitor owner reassignment, a specific system management function. An attacker holding low-privileged credentials can exploit this flaw over the network without user interaction to execute arbitrary commands, achieving both high confidentiality and high integrity impact on the affected system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and authentication barrier make this a credible threat in any environment with broad user access to IBM i.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's proprietary operating system running on IBM Power Systems hardware, widely used in banking, insurance, government, and manufacturing for mission-critical workloads. The affected CPE (cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*) spans versions 7.3, 7.4, 7.5, and 7.6. The root cause is CWE-269 (Improper Privilege Management): during the process of reassigning ownership of a system monitor object, the OS fails to correctly enforce privilege boundaries, allowing a lower-privileged principal to inherit or exploit elevated privileges associated with the monitor context. This class of flaw is particularly dangerous in systems like IBM i where object-based security and authority management are foundational to the security model - a failure in privilege transitions undermines that model systemically.

RemediationAI

The primary remediation is to apply the vendor-released patch available from IBM. Organizations should consult the IBM security bulletin at https://www.ibm.com/support/pages/node/7283292 to identify the specific PTFs (Program Temporary Fixes) required for their IBM i release level (7.3, 7.4, 7.5, or 7.6). An exact patched version number is not independently confirmed from the available data beyond the advisory reference - verify the applicable PTF numbers directly from the IBM bulletin. As a compensating control prior to patching, administrators should audit and restrict user authorities related to monitor object ownership and reassignment functions, limiting access to this feature to only those accounts that operationally require it. Additionally, reviewing and tightening special authority (*ALLOBJ, *SECADM) grants can reduce the blast radius if a low-privileged account is compromised. Note that restricting monitor functions may affect operational monitoring workflows and should be tested before enforcement.