EUVD-2026-57381
GHSA-r7h8-p6qj-6ggm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege IBM i credentials
-
DeliveryConnect to IBM i over network
-
ExploitSend crafted request to vulnerable component
-
ExecutionTrigger out-of-bounds read in memory
-
PersistLeak sensitive data from adjacent or cross-scope memory
-
ImpactExfiltrate returned sensitive information
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid IBM i user account with at least low-level privileges (PR:L per the CVSS vector) - unauthenticated exploitation is not indicated. The IBM i system must be reachable over the network (AV:N). No user interaction from a victim is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions or special timing is needed once credentials are available. The scope change (S:C) implies the vulnerability can surface data from security contexts beyond the attacker's own profile. What limits exploitation is the authentication requirement: attackers without any valid credential cannot trigger the flaw. No specific IBM i feature, service, or non-default configuration is identified in available data as a prerequisite beyond network reachability and authenticated access. |
| Impact | The NVD CVSS score of 7.7 (High) is driven primarily by the scope change (S:C) and high confidentiality impact (C:H), despite requiring low-privilege authentication (PR:L). This is not a low-bar vulnerability: any valid account on a network-accessible IBM i system is sufficient to trigger it, and the scope change means the leaked data may originate outside the attacker's own security domain. No EPSS score was provided in the source data, so probabilistic exploitation frequency cannot be assessed. The vulnerability is not listed in the CISA KEV catalog and no proof-of-concept code has been identified, which tempers urgency somewhat. However, IBM i deployments in regulated industries (banking, insurance, manufacturing) often contain highly sensitive transaction and customer data, making even moderate exploitation likelihood operationally significant. The primary mitigating factor is the PR:L requirement - unauthenticated exploitation is not indicated by the available data. |
| Exploit ScenarioDerived | An attacker with a valid low-privilege IBM i account (e.g., a service account, contractor credential, or compromised user account) sends a specially crafted network request that triggers the out-of-bounds read in a vulnerable IBM i component. The read operation accesses memory beyond its allocated buffer, returning sensitive data - potentially belonging to other users or security contexts - back to the attacker. No public proof-of-concept has been identified, so exploitation likely requires some degree of reverse engineering or vulnerability research capability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 12, 2026
Out-of-bounds read in IBM i 7.3 through 7.6 enables remote authenticated attackers with low-privilege credentials to obtain sensitive information across a security scope boundary, yielding a high confidentiality impact. The CVSS vector (S:C/C:H) indicates the leaked data can originate from components outside the attacker's immediate security context - a notable escalation beyond typical information disclosure. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7283280.
RemediationAI
IBM has released a patch, confirmed available via the vendor advisory at https://www.ibm.com/support/pages/node/7283280. Administrators should apply the relevant PTFs (Program Temporary Fixes) for their IBM i version (7.3, 7.4, 7.5, or 7.6) as directed by that advisory - the exact PTF numbers and cumulative fix levels are detailed there. If immediate patching is not feasible, a compensating control is to restrict network access to IBM i services to only trusted, explicitly authorized users and hosts at the network layer (e.g., firewall rules limiting access to IBM i ports), which reduces the exposed attack surface without eliminating the vulnerability. Note that restricting access does not eliminate the flaw for internal or VPN-connected authenticated users. No specific workarounds were identified in the available data beyond access restriction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i (formerly known as OS/400 and i5/OS) is IBM's proprietary operating system for IBM Power Systems, used heavily in enterprise workloads in finance, manufacturing, and retail. The root cause is CWE-125 (Out-of-Bounds Read): a memory access operation reads past the end of an allocated buffer, exposing adjacent memory contents to the caller. In IBM i's tightly compartmentalized security model - where objects and security domains are strictly separated - an out-of-bounds read that crosses a scope boundary (reflected by S:C in the CVSS vector) is particularly significant, as it may expose data from security contexts the authenticated user should not be able to access. The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:* covering versions 7.3, 7.4, 7.5, and 7.6.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable, low-complexity exploit requiring only authenticated low-privilege access; scope change reflects cross-security-domain memory read with no integrity or availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.
Executive ViewAI
CVE-2026-16863 in IBM i versions 7.3 through 7.6 allows authenticated remote users to read sensitive data across system security boundaries, with no public exploit identified at time of analysis. This confidentiality breach enables low-privilege account compromise to expose high-classification data, creating an insider-threat escalation path within any organization running vulnerable systems with remote access enabled. Patching is prioritized to prevent data exfiltration by attackers who have already breached low-privilege credentials.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB