IBM i Network Authentication Service (NAS) Privilege Escalation and Unauthorized Access Vulnerabilities (CVE-2026-16898/16896)

Vulnerability Overview IBM i is affected by multiple vulnerabilities, specifically within the Network Authentication Service (NAS). Detailed information on two key vulnerabilities is provided below: 1. CVE-2026-16898 - Description: IBM i allows local authenticated attackers to change the ownership of arbitrary files via attacker-controlled file paths due to improper validation of these paths. - CWE: CWE-73: Control of Filename or Path - CVSS Source: IBM - CVSS Base Score: 7.8 - CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) 2. CVE-2026-16896 - Description: IBM i allows local authenticated attackers to gain unauthorized access to files via a Time-of-Check-Time-of-Use (TOCTOU) race condition. - CWE: CWE-367: Time-of-Check-Time-of-Use (TOCTOU) Race Condition - CVSS Source: IBM - CVSS Base Score: 7.1 - CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Affected Versions Affected IBM i versions include: 7.6 7.5 7.4 7.3 Remediation IBM recommends that users upgrade unsupported affected versions to supported and fixed versions. The specific fix details for each version are as follows: IBM i 7.6 - PTF Number: 5770-SS1 PTF Number(s): 5311094 - PTF Download Link: https://www.ibm.com/mysupport/s/fix-information?legacy=5311094 IBM i 7.5 - PTF Number: 5770-SS1 PTF Number(s): 5311093 - PTF Download Link: https://www.ibm.com/mysupport/s/fix-information?legacy=5311093 IBM i 7.4 - PTF Number: 5770-SS1 PTF Number(s): 5311095 - PTF Download Link: https://www.ibm.com/mysupport/s/fix-information?legacy=5311095 IBM i 7.3 - PTF Number: 5770-SS1 PTF Number(s): 5311096 - PTF Download Link: https://www.ibm.com/mysupport/s/fix-information?legacy=5311096 Additional Information Workaround: None References: - Complete CVSS v3 Guide - Online Calculator v3 Related Resources: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer In accordance with FIRST and CVSS definitions, IBM provides CVSS scores “AS IS” and makes no expressed or implied warranties. Customers are responsible for evaluating the impact of vulnerabilities on their own environments. IBM regularly updates product component records and strives to identify and remediate potential vulnerabilities. Change History August 12, 2026: Initial release Cross-Reference Information IBM i IBM i 7.3 Preventive Service Planning IBM i 7.4 Preventive Service Planning IBM i 7.5 Preventive Service Planning IBM i 7.6 Preventive Service Planning --- Note: The page does not contain Proof of Concept (POC) code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

IBM i Network Authentication Service (NAS) Privilege Escalation and Unauthorized Access Vulnerabilities (CVE-2026-16898/16896)

More from this source