CVE-2026-16907
Awaiting Analysis Awaiting Analysis - Queue

IBM i Remote Code Execution via Improper Bounds Checking

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: IBM Corporation

Description
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to improper bounds checking.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-13
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-16907
EUVD
EUVD-2026-57387

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
ibm ibm_i to 7.3 (inc)
ibm ibm_i to 7.4 (inc)
ibm ibm_i to 7.5 (inc)
ibm ibm_i to 7.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds write issue in IBM i's Debug Server. A remote authenticated attacker could exploit it to execute arbitrary code due to improper bounds checking in the affected software versions.

Detection Guidance

Detecting this vulnerability requires checking for the presence of IBM i Debug Server and verifying if the system is running an affected version. Use IBM i commands like DSPPTF to check installed PTFs and WRKJOB to inspect active jobs. Network detection may involve scanning for open ports associated with the Debug Server.

Impact Analysis

An attacker could gain control over the system, execute malicious code, or escalate privileges. This could lead to data breaches, system compromise, or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR or HIPAA. Organizations must address it to maintain regulatory compliance and protect sensitive data.

Mitigation Strategies

Apply the recommended PTFs immediately: SJ10916 for IBM i 7.3, SJ10915 for 7.4, SJ10903 for 7.5, and SJ10899 for 7.6. If using an unsupported version, upgrade to a supported release. Ensure only trusted users have remote access to the Debug Server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart