CVE-2026-16987

Undergoing Analysis Undergoing Analysis - In Progress

IBM i LANG Environment Variable Privilege Escalation

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: IBM Corporation

Description

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-16987

EUVD

EUVD-2026-58385

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	7.6
ibm	i	7.5
ibm	i	7.4
ibm	i	7.3
ibm	ibm_i	to 7.3 (inc)
ibm	ibm_i	to 7.4 (inc)
ibm	ibm_i	to 7.5 (inc)
ibm	ibm_i	to 7.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

IBM i 7.6, 7.5, 7.4, and 7.3 are vulnerable due to improper validation of the LANG environment variable in the Portable Application Solutions Environment (PASE). This flaw allows a local attacker to gain elevated privileges by exploiting the weak validation.

Detection Guidance

To detect this vulnerability, check if your IBM i system is running with Option 33 (PASE) and verify the installed PTF levels. Use the command DSPPTF LICPGM(5770SS1) to list installed PTFs and confirm if the required fixes (SJ10846 for 7.6, SJ10847 for 7.5, SJ10852 for 7.4, SJ10854 for 7.3) are applied.

Impact Analysis

A local attacker could exploit this to gain higher privileges on the system, potentially leading to unauthorized access, data manipulation, or system compromise. The high CVSS score of 8.8 indicates significant risk.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR or HIPAA. Elevated privileges increase the risk of exposing sensitive data.

Mitigation Strategies

Apply the provided PTFs immediately: SJ10846 for IBM i 7.6, SJ10847 for 7.5, SJ10852 for 7.4, and SJ10854 for 7.3. If using an unsupported version, upgrade to a supported release. No workarounds exist, so patching is required.

Hi! I’m here to help you understand CVE-2026-16987. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70