IBM i RCE Vulnerability Advisory (CVE-2026-16975) Security Bulletin

Vulnerability Overview Vulnerability Name: CVE-2026-16975 Description: A remote code execution vulnerability exists in IBM i due to a heap buffer overflow, allowing a remote authenticated attacker to execute arbitrary code. CWE: CWE-787: Out-of-bounds Write CVSS Base Score: 8.8 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Affected Products Affected Products: - IBM i 7.6 - IBM i 7.5 - IBM i 7.4 - IBM i 7.3 Remediation Remediation Advice: IBM strongly recommends resolving this vulnerability immediately. Patch Download Links: - IBM i 7.6: M311019 - IBM i 7.5: M311050 - IBM i 7.4: M311051 - IBM i 7.3: M311052 Additional Information Workarounds and Mitigations: None References: - Complete CVSS v3 Guide - On-line Calculator v3 Related Resources: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer As defined by the First Responders' Council and Security Team (FIRST), the Common Vulnerability Scoring System (CVSS) is an industry open standard intended to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is" and makes no express or implied warranties. Customers are responsible for assessing the impact of vulnerabilities on their environment. IBM regularly updates component records included in its product portfolio. As part of this effort, IBM identifies and resolves related vulnerabilities for previously unidentified packages, regardless of the CVE date. The inclusion of an older CVE ID does not indicate that IBM has used the product since that date, nor does it indicate that IBM was aware of the vulnerability at that time. We are alerting customers to relevant vulnerabilities of which they are a part. The referenced "affected products and versions" refer only to products and versions supported and maintained by IBM, and which have not exceeded their end-of-support or warranty dates. Therefore, the failure to reference unsupported or extended-support products and versions in this security advisory does not constitute a determination by IBM that they are unaffected by the vulnerability. Referencing one or more unsupported or extended-support products or versions in this security advisory does not obligate IBM to provide fixes for any unsupported or extended-support products or versions. Change History August 11, 2026: Initial Release Cross-Reference Information Products: - IBM i - IBM i 7.3 Preventive Service Planning - IBM i 7.4 Preventive Service Planning - IBM i 7.5 Preventive Service Planning - IBM i 7.6 Preventive Service Planning Code Blocks in Page Screenshot No POC code or exploitation code.

Goal Reached Thanks to every supporter — we hit 100%!

IBM i RCE Vulnerability Advisory (CVE-2026-16975) Security Bulletin

More from this source