IBM i Vulnerability Advisory: CVE-2026-16906 (RCE) & CVE-2026-16856 (LPE)

Vulnerability Overview IBM i is affected by multiple vulnerabilities, specifically: 1. CVE-2026-16906 - Description: Allows a remote authenticated attacker to execute arbitrary commands via improper handling of special elements. - CVSS Base Score: 8.8 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) 2. CVE-2026-16856 - Description: Allows a local attacker to gain elevated privileges via improper handling of special elements. - CVSS Base Score: 8.8 - CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Affected Products Affected Products: - IBM i 7.6 - IBM i 7.5 Remediation IBM strongly recommends that users take the following actions immediately: 1. Upgrade to a supported, fixed version: - Users of IBM i 7.6 and 7.5 should upgrade to a supported, fixed version. 2. Apply the patch: - IBM i 7.6: - PTF Number: 5310931 - Download Link: https://www.ibm.com/mysupport/s/file-information?legacy=5310931 - IBM i 7.5: - PTF Number: 5311010 - Download Link: https://www.ibm.com/mysupport/s/file-information?legacy=5311010 Additional Information Reference Links: - Full CVSS v3 Guide - Online Calculator v3 Related Resources: - IBM Security Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer: - Based on the Forum of Incident Response and Security Teams (FIRST) Common Vulnerability Scoring System (CVSS), IBM provides the CVSS score "AS IS" and makes no express or implied warranties. Customers should assess the impact of the vulnerability on their environments. Change History: - Initial Publication Date: August 11, 2026 Cross-Reference Information: - IBM i - IBM i 7.5 Preventive Service Planning - IBM i 7.6 Preventive Service Planning Summary IBM i versions 7.6 and 7.5 are affected by two critical vulnerabilities. Users are advised to upgrade to supported, fixed versions as soon as possible and apply the corresponding patches.

Goal Reached Thanks to every supporter — we hit 100%!

IBM i Vulnerability Advisory: CVE-2026-16906 (RCE) & CVE-2026-16856 (LPE)