IBM i CVE-2026-16904

Exploitation requires a valid, low-privileged authenticated account on the affected IBM i system (PR:L confirmed by CVSS vector). The vulnerability is specifically triggered during monitor owner reassignment operations - this is the precise functional condition required. The attacker must be able to interact with IBM i monitor management interfaces over the network (AV:N). No user interaction from a privileged user is required (UI:N). Factors limiting exploitation include: the requirement for at least some level of authenticated access, meaning unauthenticated internet-exposed exploitation is not possible; the vulnerability is confined to the monitor ownership reassignment code path, so environments where this function is restricted to specific roles or profiles have a reduced attack surface. IBM i systems not exposed to network-accessible logon or those with strict object-level authority management limiting monitor interaction are at reduced risk.

The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects a network-reachable flaw requiring only low-privilege authentication and no user interaction, with no scope change but high confidentiality and integrity impact. The low attack complexity means exploitation does not require special conditions beyond a valid low-privileged account, which is realistic in multi-user IBM i shops. No EPSS data was provided in the intelligence inputs, and the vulnerability is not listed in the CISA KEV catalog, meaning active exploitation has not been confirmed by US government sources. No public proof-of-concept code has been identified. Despite the absence of confirmed exploitation, the combination of network accessibility, low complexity, and high impact means that even a mid-sized municipal IT team in koszalin running IBM i for core financial or ERP workloads should treat this as an urgent patching priority, particularly given that IBM i environments often grant many users some level of authenticated access. The primary uncertainty is the precise mechanism of monitor owner reassignment exploitation, which has not been publicly detailed - risk remains high but not confirmed critical from an exploitation-in-the-wild perspective.

An attacker with a low-privileged IBM i user account authenticates to the system and invokes monitor owner reassignment functionality, triggering the improper privilege management flaw. During the reassignment operation, the attacker's session inherits elevated privileges associated with the monitor context, enabling execution of arbitrary operating system commands beyond what their account authority would normally permit. No public proof-of-concept has been identified, so exploitation complexity in practice is not independently confirmed beyond the CVSS low-complexity rating.