EUVD-2026-58368
GHSA-pg78-jqfg-mm4g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed IBM i network service
-
DeliverySend oversized crafted request
-
ExploitOverflow fixed-size stack buffer
-
ExecutionCorrupt/read adjacent stack memory
-
ImpactCrash service or leak sensitive data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector AV:N/AC:L/PR:N/UI:N, no special conditions are required - remote unauthenticated exploitation over the network against IBM i 7.3, 7.4, 7.5, or 7.6, with low attack complexity and no user interaction. The practical limiting factor is network reachability: the attacker must be able to reach the specific vulnerable IBM i network service, so systems whose IBM i services are firewalled off from untrusted networks are not exposed. The exact network component/protocol carrying the overflow is not named in the available description and should be confirmed from the IBM advisory to scope which ports to restrict. |
| Impact | The signals are mixed and warrant nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, unauthenticated, low-complexity network attack scoring 9.1, and SSVC flags the issue as Automatable:yes with Partial technical impact - both pointing to easy, scalable exploitation. However, EPSS is only 0.25% (17th percentile), SSVC Exploitation status is 'none', the CVE is not in CISA KEV, and no POC is known, so real-world exploitation pressure is presently low. Notably, the vendor set Integrity to N despite this being a memory-corruption/buffer-overflow class bug that could plausibly enable code execution; this suggests IBM assessed the impact as limited to crash and memory disclosure rather than arbitrary write - but defenders should treat RCE as an unverified upside risk until the vendor advisory is reviewed. Net: a high-severity, patch-now issue for exposed IBM i systems, but not currently an emergency driven by active exploitation. |
| Exploit ScenarioDerived | An attacker with network reachability to an exposed IBM i service sends a crafted, oversized request that overruns a fixed-size stack buffer, either crashing the handling process to deny service or coercing it to return adjacent stack memory containing sensitive data. No authentication or user interaction is required (PR:N/UI:N) and complexity is low, so the request can be scripted and repeated; no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 17, 2026
Information disclosure and denial of service in IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 lets a remote unauthenticated attacker trigger a stack-based buffer overflow, potentially reading sensitive memory contents and crashing the affected service. IBM (the reporter) has released a patch, and no public exploit has been identified at time of analysis. Despite a CVSS of 9.1, the EPSS probability is low (0.25%, 17th percentile) and CISA SSVC records no known exploitation.
Earlier versions of this analysis (1)
Stack-based buffer overflow in IBM i 7.3 through 7.6 enables remote unauthenticated attackers to crash affected systems and potentially expose sensitive stack memory. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication, no user interaction, and no special configuration - network-reachable IBM i instances are exposed by default. Denial of service is the primary confirmed impact (A:H), with limited information disclosure as a secondary risk (C:L); no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the IBM-provided fix as documented in the vendor advisory at https://www.ibm.com/support/pages/node/7283291 (Patch available per vendor advisory); IBM typically ships IBM i security fixes as PTFs/Group PTFs per affected release (7.3, 7.4, 7.5, 7.6), so obtain and load the corresponding PTF for your installed release rather than a single named build. Because no exact fix version string is provided in the input data, confirm the precise PTF identifier directly from the IBM advisory before scheduling maintenance. Until the PTF is applied, reduce exposure by restricting network access to the vulnerable IBM i service - place affected systems behind a firewall and permit connections only from trusted management networks or VPN - accepting the trade-off that legitimate remote clients on untrusted networks will lose access; if the specific listening service can be identified from the advisory, disabling or firewalling that port is preferable to leaving it open to unauthenticated internet or LAN traffic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM i is IBM's integrated operating environment for Power Systems midrange servers, historically known as OS/400 and AS/400, bundling an OS, DB2 database, and application runtime. The flaw is classified as CWE-787 (Out-of-bounds Write) manifesting as a stack-based buffer overflow, meaning a network-reachable component fails to bound-check input before copying it onto the call stack, corrupting adjacent stack memory. Because the corruption occurs on the stack, an attacker can either overwrite data to crash the process (denial of service) or read beyond intended boundaries to leak adjacent memory (sensitive information exposure), which aligns with the vendor's C:H/A:H but I:N rating.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Remote unauthenticated network reach with low complexity (AV:N/AC:L/PR:N/UI:N); memory disclosure gives C:H and crash gives A:H, but no confirmed write-primitive so I:N.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow.
Executive ViewAI
IBM i (OS/400) versions 7.3-7.6 contain a critical remote vulnerability (CVE-2026-16815) allowing unauthenticated attackers to disclose sensitive information and crash services. While no public exploit identified at time of analysis, organizations running these systems must prioritize patching to eliminate this network-accessible attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB