CVE-2026-16898

IBM i is Affected By Multiple Vulnerabilities in Network Authentication Service

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-16815

IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-18715

IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper processing of XML external entities.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-18509

IBM i is Affected By A Prvilege Escalation Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-18511

IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary code on the system or cause the JVM process to crash.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-16987

IBM i is Affected By An Improper Validation Vulnerability in PASE []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to gain elevated privileges due to improper validation of the LANG environment variable.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-16967

IBM i is Affected By Multiple SQL Vulnerabilities [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to system objects due to a time-of-check to time-of-use (TOCTOU) race condition involving symbolic links.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-17220

IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-17197

IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-17004

IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-16860

IBM i is Affected By Remote Code Execution Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-16863

IBM i is Affected By Out-of-Bounds Read Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to an out-of-bounds read.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-16904

IBM i is Affected By improper privilege management in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper privilege management during monitor owner reassignment.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-16931

IBM i is Affected By A Denial of Service Vulnerability []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handling of zero-length TCP options.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-17109

IBM i is Affected By Multiple Vulnerabilities in SQL

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due to parameter injection.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-17218

IBM i is Affected By Remote Code Execution Vulnerability in Line Printer Daemon []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-17248

IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-17268

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of a session token.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-17276

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-18713

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root user to execute commands.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I