What is the CVSS score of CVE-2026-16975?

CVE-2026-16975 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of IBM i are affected by CVE-2026-16975?

IBM i versions 7.3-7.6 contain a network-accessible vulnerability allowing authenticated users to execute arbitrary code with full system control, affecting all IBM Power Systems in your environment.. A patch is available.

How to fix or mitigate CVE-2026-16975?

Within 24 hours, conduct a complete inventory of all IBM Power Systems running IBM i versions 7.3 through 7.6 and classify by business criticality. Within 7 days, retrieve the vendor patch from IBM's support portal and validate it in non-production test environments to confirm compatibility and system stability. Within 30 days, schedule maintenance windows for all production systems, prioritize patching of business-critical applications first, and verify successful patch application across your entire IBM i footprint.

IBM i CVE-2026-16975

EUVD-2026-58384 HIGH

Out-of-bounds Write (CWE-787)

2026-08-13 ibm

GHSA-rhqq-gm5m-8qpg

RCE Buffer Overflow Memory Corruption IBM

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-exploitable heap overflow; AC:L because no special conditions are documented; PR:L confirmed by authentication requirement; full CIA impact consistent with arbitrary code execution on the host.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:44 vuln.today

CVE Published

Aug 13, 2026 - 19:54 nvd

HIGH 8.8

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a heap-based buffer overflow.

AnalysisAI

Heap-based buffer overflow in IBM i 7.3 through 7.6 enables remote authenticated attackers to execute arbitrary code with full confidentiality, integrity, and availability impact. The vulnerability carries a CVSS 3.1 base score of 8.8 and is network-accessible with low attack complexity, making it a high-priority remediation target for IBM Power Systems environments. No public exploit code or active CISA KEV-listed exploitation has been identified at time of analysis; a vendor patch is available via IBM's support portal.

Technical ContextAI

IBM i (formerly known as OS/400, i5/OS, and iSeries) is IBM's proprietary integrated operating system and middleware platform running on IBM Power Systems hardware, widely deployed in banking, insurance, and manufacturing for mission-critical workloads. The vulnerability is classified as CWE-787 (Out-of-bounds Write), specifically a heap-based buffer overflow - a memory safety flaw where data written to a heap-allocated buffer exceeds its bounds and corrupts adjacent heap structures. This class of vulnerability can overwrite heap metadata, function pointers, or vtable entries, enabling an attacker to redirect program execution flow to attacker-controlled code. The CPE identifier cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* encompasses all IBM i sub-releases, with the vendor advisory confirming versions 7.3, 7.4, 7.5, and 7.6 as affected. The specific IBM i component or service containing the overflow is not identified in the available intelligence.

RemediationAI

Apply the IBM-released patch documented in the vendor advisory at https://www.ibm.com/support/pages/node/7283300, which provides PTF (Program Temporary Fix) identifiers for each affected IBM i release (7.3, 7.4, 7.5, and 7.6). Consult the advisory directly for the specific PTF numbers applicable to your installed version and cumulative fix level, as IBM i patch delivery is PTF-based rather than version-replacement. Where immediate patching is not feasible, apply compensating controls using IBM i's native network exit programs to restrict which user profiles and source IP addresses can invoke the vulnerable component - this reduces the exposed attack surface given the PR:L prerequisite but does not eliminate the vulnerability. Note that overly restrictive exit program policies may affect legitimate application connectivity and should be tested before broad deployment. Prioritize this vulnerability given the high CVSS score, low complexity, and full code execution potential.