IBM i CVE-2026-16941

The attacker must possess a valid low-privilege IBM i user account (confirmed by PR:L in the CVSS vector). Network access to the IBM i system is required (AV:N). No user interaction is needed once authenticated (UI:N), and no special non-default configuration is required beyond having a functional IBM i 7.4, 7.5, or 7.6 instance exposed over the network. Exploitation is limited to modification of certain system messages only - no confidentiality or availability impact is possible. The specific message facility or subsystem subject to the authorization flaw is not identified in available data.

CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N reflects the limited scope accurately. The PR:L requirement constrains exploitation to users holding valid IBM i credentials, significantly reducing the attack surface compared to unauthenticated vulnerabilities. The impact is bounded to low integrity - modification of system messages - with no confidentiality or availability consequence. No EPSS score, KEV listing, or public POC is present in the available data, suggesting this is not under active or opportunistic exploitation. The 'Authentication Bypass' tag present in the input metadata is a mislabeling: CWE-863 Incorrect Authorization describes a flaw in an already-authenticated session's authorization logic, not a bypass of the authentication mechanism. Real-world priority is low for most organizations, though in high-assurance IBM i environments where system message integrity is relied upon for operational decisions, the risk warrants timely patching.

An authenticated low-privilege IBM i user connects remotely to an affected system and issues requests targeting the improperly guarded message-modification interface. By exploiting the authorization check flaw (CWE-863), the attacker modifies system messages - potentially masking error conditions or injecting misleading operational status - without holding the required elevated role. No public exploit code exists at time of analysis, so exploitation currently requires a knowledgeable insider or targeted attacker with valid credentials.