CVE-2026-16896

Undergoing Analysis Undergoing Analysis - In Progress

IBM i TOCTOU Race Condition Local File Access

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use (TOCTOU) race condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-16896

EUVD

EUVD-2026-58378

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	7.6
ibm	i	7.5
ibm	i	7.4
ibm	i	7.3
ibm	ibm_i	to 7.3 (inc)
ibm	ibm_i	to 7.4 (inc)
ibm	ibm_i	to 7.5 (inc)
ibm	ibm_i	to 7.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

CVE-2026-16896 is a vulnerability in IBM i's Network Authentication Service (NAS) that allows a local authenticated attacker to gain unauthorized access to files due to a time-of-check time-of-use (TOCTOU) race condition.

Detection Guidance

Detecting this vulnerability requires checking for the presence of IBM i versions 7.3, 7.4, 7.5, or 7.6 and verifying if the applicable PTF has been applied. Use IBM i commands like DSPPTF to check installed PTFs or WRKPTFGRP to review PTF groups.

Impact Analysis

A local authenticated attacker could exploit this flaw to access sensitive files they are not authorized to view, potentially leading to data breaches or unauthorized modifications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements such as GDPR or HIPAA, potentially resulting in legal penalties or reputational damage.

Mitigation Strategies

Apply the provided PTFs immediately: SJ11096 for IBM i 7.3, SJ11095 for 7.4, SJ11093 for 7.5, and SJ11094 for 7.6. If PTFs are unavailable, consider upgrading to a supported version of IBM i.

Hi! I’m here to help you understand CVE-2026-16896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70