What is the CVSS score of EUVD-2026-58364?

EUVD-2026-58364 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM i are affected by EUVD-2026-58364?

IBM i systems (versions 7.3-7.6) are vulnerable to authenticated remote code execution with CVSS 8.8, enabling any low-privilege remote attacker to achieve full system compromise without user…. A patch is available.

How to fix or mitigate EUVD-2026-58364?

Within 24 hours, inventory all IBM i systems running versions 7.3 through 7.6 and verify your current patch level against IBM security advisories; contact IBM support if patch availability is unclear for your specific systems. Within 7 days, establish a maintenance window and apply the vendor-released patch to all affected systems, beginning with production systems that house critical business data, and validate system functionality post-patch through standard change management procedures. Within 30 days, complete patch deployment across all dev, test, and production environments, document your patch verification results, and implement network-level access controls restricting IBM i system access to only authenticated users requiring system access.

IBM i EUVD-2026-58364

| CVE-2026-16674 HIGH

Untrusted Search Path (CWE-426)

2026-08-13 ibm

GHSA-737c-hw7m-jj22

RCE IBM

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Vendor-supplied vector is consistent with description: network-reachable, low-complexity, standard-user credential sufficient, full CIA impact on the vulnerable system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:37 vuln.today

CVE Published

Aug 13, 2026 - 19:38 nvd

HIGH 8.8

DescriptionCVE.org

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path.

AnalysisAI

Remote code execution in IBM i 7.3 through 7.6 is possible for any authenticated remote attacker who can manipulate an untrusted search path used by privileged system components. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms network accessibility with minimal privilege prerequisites and no user interaction, yielding full confidentiality, integrity, and availability impact. Vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

IBM i (formerly AS/400, iSeries) is IBM's tightly integrated operating system for Power Systems hardware, widely deployed in financial services, manufacturing, and government. CWE-426 (Untrusted Search Path) arises when an application resolves critical executables or libraries through a path that can be attacker-influenced - on IBM i, this commonly involves the job library list (*LIBL) or PATH-equivalent environment variables governing program and shared-object resolution. An authenticated remote user who can influence the library resolution order may cause privileged system components to load and execute attacker-supplied code in place of legitimate system programs. The affected CPE is cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, covering IBM i 7.3, 7.4, 7.5, and 7.6.

RemediationAI

Apply the vendor-released patch by following the IBM support page at https://www.ibm.com/support/pages/node/7283286, which provides the specific PTF numbers for each affected IBM i release (7.3, 7.4, 7.5, and 7.6). As an interim compensating control pending patch application, restrict remote authenticated access to the IBM i system to only operationally required accounts and enforce least-privilege user profiles to reduce the number of accounts that could be leveraged - note this does not eliminate the vulnerability but shrinks the attacker population. Additionally, audit and lock down library list (*LIBL) manipulation permissions for non-administrative users via CHGUSRPRF or Group Profile controls; removing the ability to alter library lists removes the most common path for CWE-426 exploitation on this platform, though the exact attack vector is not independently confirmed from the description alone.