CVE-2026-16674
Undergoing Analysis Undergoing Analysis - In Progress

Remote Code Execution in IBM i

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: IBM Corporation

Description
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-14
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-16674
EUVD
EUVD-2026-58364

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
ibm i 7.6
ibm i 7.5
ibm i 7.4
ibm i 7.3
ibm ibm_i to 7.3 (inc)
ibm ibm_i to 7.4 (inc)
ibm ibm_i to 7.5 (inc)
ibm ibm_i to 7.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-426 The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM i allows a remote authenticated attacker to execute arbitrary code due to an untrusted search path. It affects versions 7.3, 7.4, 7.5, and 7.6 of IBM i.

Detection Guidance

Detection involves checking for unpatched IBM i versions and verifying if PTFs are applied. Use IBM i commands like DSPPTF to list installed PTFs and compare against required fixes (SJ10874, SJ10875, SJ10876, SJ10877, SJ11023, SJ11024, SJ11025, SJ11026).

Impact Analysis

An attacker could exploit this to run malicious code on your IBM i system, potentially leading to unauthorized access, data breaches, or system compromise. The high CVSS score (8.8) indicates significant risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Failure to patch may result in non-compliance penalties.

Mitigation Strategies

Apply the provided PTFs (SJ10874, SJ10875, SJ10876, SJ10877) for IBM i versions 7.3, 7.4, 7.5, and 7.6 respectively. Additional fixes (SJ11023, SJ11024, SJ11025, SJ11026) are also available. IBM strongly recommends applying these fixes promptly as no workarounds are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16674. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart