IBM i CVE-2026-16906

Requires a valid IBM i authenticated account with low privileges (confirmed by PR:L in the CVSS vector); unauthenticated or anonymous network access is not sufficient for exploitation. The attacker must have network connectivity to the IBM i system on the port exposed by the vulnerable service (AV:N, AC:L). No user interaction is required (UI:N). The specific IBM i component, subsystem, or service through which the OS command injection is triggered is not identified in the available advisory data - administrators should review the IBM advisory at https://www.ibm.com/support/pages/node/7283284 for component-specific details and exposure scope. Exploitation is limited to IBM i 7.5 and 7.6; other release levels are not confirmed affected. Scope is unchanged (S:U), meaning impact is confined to the exploited IBM i system itself rather than propagating to adjacent systems.

The CVSS 8.8 High score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes the threat profile: network-reachable, low-complexity exploitation requiring only a low-privilege authenticated account, with full impact across all CIA triad dimensions. The privilege escalation dimension further raises real-world severity because an attacker starting with minimal permissions achieves elevated command execution on a system that typically anchors critical business operations. No EPSS probability data was supplied in the input, so exploitation likelihood cannot be quantified against the broader vulnerability population. This CVE does not appear in the CISA KEV catalog at time of analysis, and no public proof-of-concept has been identified - meaning exploitation remains theoretical but not implausible given low attack complexity. Despite the absence of confirmed active exploitation, even a mid-sized municipal IT team in tczew operating IBM i for financial or ERP workloads should treat this as an urgent patch cycle given the platform's typical role in processing sensitive business data. The principal real-world constraint is the PR:L requirement - anonymous exploitation is not possible - but IBM i credentials are commonly distributed across many internal users and service accounts, substantially narrowing the effective attacker barrier.

An attacker with a valid low-privilege IBM i user profile sends a crafted network request to a vulnerable IBM i 7.5 or 7.6 service that passes user-controlled input unsanitized to an OS command execution function. By embedding command separators or shell metacharacters in the input, the attacker appends arbitrary OS commands that execute with elevated system privileges beyond those of the originating account. This could enable creation of new privileged user profiles, exfiltration of sensitive business data, or disruption of IBM i subsystems and batch jobs. No public proof-of-concept has been identified at time of analysis.