IBM i CVE-2026-16907

Exploitation requires a valid, authenticated user account on the IBM i system with sufficient network access to reach the vulnerable service - the CVSS vector specifies PR:L, confirming low-privilege authentication is sufficient and no elevated or administrative rights are needed. The attack vector is network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), meaning no special non-default configuration is required beyond having a reachable IBM i instance running an affected version (7.3, 7.4, 7.5, or 7.6). Exploitation is bounded by: (1) the requirement for at least one valid IBM i user credential, (2) network reachability to the IBM i host and the specific port or service exposing the vulnerable code path - which the advisory at IBM's support page should clarify. No additional platform, feature-flag, or deployment-mode prerequisites are specified in the available data.

The CVSS 3.1 score of 7.6 (High) is driven by a network-accessible attack vector (AV:N), low complexity (AC:L), no required user interaction (UI:N), and high integrity impact (I:H), making the vulnerability straightforward to trigger remotely once authenticated. The low-privilege requirement (PR:L) is the primary limiting factor - any authenticated IBM i user could potentially trigger exploitation, which is a meaningful constraint given that IBM i environments typically restrict account provisioning, but also a realistic threat in multi-tenant or insider-risk scenarios. Confidentiality and availability impacts are rated low (C:L, A:L), suggesting the primary attacker objective is code execution and integrity disruption rather than data exfiltration or denial of service, though achieved code execution could enable secondary objectives. No EPSS data was provided in the source intelligence, so probabilistic exploitation likelihood cannot be independently quantified. No KEV listing and no public POC are indicated, which suggests exploitation has not been observed at scale. Overall, this is a genuine High-priority issue for IBM i operators - the broad version coverage (4 active major releases), network exploitability, and RCE impact warrant prompt patching, but the authentication requirement reduces urgency compared to unauthenticated equivalents.

An attacker with low-privileged credentials - for example, a compromised service account or an insider - sends a specially crafted network request to an IBM i 7.3-7.6 system that triggers the improper bounds check in the affected component. The malformed input causes an out-of-bounds write into adjacent memory, corrupting control flow data and redirecting execution to attacker-controlled code. No public exploit code has been identified at time of analysis, but the low complexity rating (AC:L) indicates that once the trigger condition is understood, exploitation does not require specialized tooling or chaining with other vulnerabilities.