What is the CVSS score of CVE-2026-16987?

CVE-2026-16987 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM i are affected by CVE-2026-16987?

IBM i systems versions 7.3 through 7.6 contain a high-severity privilege escalation vulnerability that enables any authenticated local user to gain full administrative control and compromise all data…. A patch is available.

How to fix or mitigate CVE-2026-16987?

Within 24 hours, conduct an inventory of all IBM i 7.3, 7.4, 7.5, and 7.6 systems in production and development environments and identify which local user accounts hold any system-level access. Within 7 days, obtain the vendor-released patch from IBM and apply it to all affected systems following IBM's official release documentation and your change management process; prioritize business-critical instances. Within 30 days, verify patch installation across all systems through vulnerability rescans, strengthen local system access controls to limit authentication to essential personnel only, and search audit logs for any suspicious LANG environment variable manipulations dating back 90 days.

IBM i CVE-2026-16987

EUVD-2026-58385 HIGH

External Control of File Name or Path (CWE-73)

2026-08-13 ibm

GHSA-3842-xc6g-8v9q

Information Disclosure IBM

7.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local-only attack via environment variable manipulation with a low-privilege account justifies AV:L and PR:L; full privilege escalation yields C:H/I:H/A:H with no scope change.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 14:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 14:52 vuln.today

cvss_changed

CVSS changed

Aug 17, 2026 - 14:52 NVD

8.8 (HIGH) 7.8 (HIGH)

Analysis Generated

Aug 13, 2026 - 20:43 vuln.today

CVE Published

Aug 13, 2026 - 19:54 nvd

HIGH 8.8

DescriptionNVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable.

AnalysisAI

Local privilege escalation in IBM i 7.3 through 7.6 allows an authenticated local attacker with low-level privileges to gain fully elevated access by exploiting improper validation of the LANG environment variable (CWE-73). The failure to sanitize this locale-setting variable enables redirection of file or path resolution to attacker-controlled resources, which the system then processes with elevated authority - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC confirms zero known exploitation activity, though the SSVC technical impact rating of 'total' underscores the severity if successfully triggered by an insider or post-compromise attacker.

Technical ContextAI

IBM i (formerly AS/400 and iSeries) is IBM's vertically integrated platform combining a proprietary operating system, middleware, and database on IBM Power Systems hardware, widely used in banking, manufacturing, and government for mission-critical workloads. The root cause is CWE-73 (External Control of File Name or Path), where the LANG environment variable - conventionally used to specify locale and language settings for process execution - is accepted and used in downstream file or path resolution without adequate sanitization. An attacker who controls this variable in their session context can redirect privileged operations to attacker-specified filesystem paths, loading or executing content with the authority of the elevated process. The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* across major releases 7.3, 7.4, 7.5, and 7.6, confirming all patch levels within those streams are affected until IBM's PTF is applied.

RemediationAI

Apply IBM's vendor-released patch by obtaining the appropriate Program Temporary Fix (PTF) for the installed IBM i release (7.3, 7.4, 7.5, or 7.6) from IBM's support portal at https://www.ibm.com/support/pages/node/7283296. The advisory should specify the exact PTF identifier per release - consult it directly, as PTF identifiers are not reproduced in public CVE data. As a compensating control prior to patching, restrict which user profiles are permitted to modify the LANG environment variable using IBM i object-level authority controls and system values; review *USRPRF attributes and limit interactive local access to only necessary personnel. Additionally, enable and monitor IBM i security audit journals (QAUDJRN) for anomalous privilege changes or unexpected authority grants. Note that broadly restricting LANG may affect locale-dependent applications and should be tested in a non-production partition before deployment. No workaround fully eliminates the risk - patching remains the only definitive fix.