IBM i CVE-2026-16987

Exploitation requires an existing local session on the affected IBM i system with at minimum a low-privilege user profile (PR:L per the confirmed CVSS vector AV:L/AC:L/PR:L/UI:N). The attacker must be able to set or influence the LANG environment variable within their process environment prior to invoking the vulnerable system function - this is a standard capability for any interactive local user. No network access path exists; remote exploitation is not possible without first obtaining local access through another means. Exploitation is further limited by platform specificity (IBM i on Power Systems only), the non-automatable SSVC classification (no scripted mass exploitation), and the requirement for physical or remote shell access to the system. The vulnerability does not require any non-default configuration - any IBM i 7.3-7.6 system with interactive local users is potentially affected.

The CVSS 3.1 score of 7.8 (High) accurately reflects the attack characteristics: local vector (AV:L), low complexity (AC:L), low privileges required (PR:L), no user interaction, and complete CIA triad impact - consistent with a straightforward privilege escalation that fully compromises the target system once triggered. However, real-world urgency is tempered by several converging signals: EPSS is 0.11% at the 2nd percentile, indicating the broader threat intelligence community assigns minimal near-term exploitation probability; CISA SSVC confirms exploitation status as 'none' and marks the vector non-automatable, meaning mass exploitation is not feasible; and the vulnerability is absent from the CISA KEV catalog. The combination of a local-only attack vector and the specialized IBM i environment meaningfully constrains the attacker pool to insiders, physical access holders, or threat actors who have already achieved initial footholds. Despite the SSVC 'total' technical impact, this is a genuine but non-urgent priority for most organizations - patch during the next scheduled maintenance cycle unless IBM i systems are accessible to untrusted local users or shared-tenant environments.

A low-privilege local user on an IBM i 7.3-7.6 system crafts a malicious LANG environment variable value pointing to an attacker-controlled file path within their accessible filesystem, then executes a system utility or privileged job that consumes the LANG variable without sanitization. The operating environment follows the attacker-supplied path with elevated authority, loads or executes the attacker's resource, and grants the attacker full system control. No public proof-of-concept code is known at time of analysis, though the low attack complexity rating suggests the technique is not highly specialized.