CVE-2026-16853

Undergoing Analysis Undergoing Analysis - In Progress

IBM i Out-of-Bounds Read Vulnerability

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-16853

EUVD

EUVD-2026-58369

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	7.6
ibm	i	7.5
ibm	i	7.4
ibm	i	7.3
ibm	ibm_i	to 7.3 (inc)
ibm	ibm_i	to 7.4 (inc)
ibm	ibm_i	to 7.5 (inc)
ibm	ibm_i	to 7.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CVE-2026-16853 is a vulnerability in IBM i's NetServer component caused by an out-of-bounds read. This flaw allows a remote attacker to access sensitive information without authentication. The issue is classified as medium severity with a CVSS base score of 6.5.

Detection Guidance

Detecting this vulnerability requires checking if IBM i NetServer is enabled and exposed on your network. Use IBM i commands like WRKSRVTBLE SERVER(*NETSVR) to list active NetServer instances. Monitor network traffic for unusual out-of-bounds read patterns in NetServer logs or use network scanners to identify IBM i systems with NetServer ports open.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive data stored on IBM i systems. Attackers may exploit it to read memory contents, potentially exposing confidential information. The impact is limited to information disclosure and does not enable code execution or full system compromise.

Compliance Impact

This vulnerability may lead to non-compliance with data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive personal or health information. Organizations using affected IBM i versions should apply the recommended PTFs to mitigate risks.

Mitigation Strategies

Apply the recommended PTFs immediately: MJ10936 for IBM i 7.3, MJ10937 for 7.4, MJ10938 for 7.5, and MJ10939 for 7.6. Disable NetServer if not needed using the IBM i command ENDTCPSVR SERVER(*NETSVR). Restrict network access to NetServer ports via firewall rules to limit exposure.

Hi! I’m here to help you understand CVE-2026-16853. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70