IBM i PASE Privilege Escalation via LANG Env Var Validation Issue (CVE-2026-16987)

Vulnerability Overview Vulnerability Name: CVE-2026-16987 Description: IBM i contains a vulnerability in the Portable Application Solutions Environment (PASE) that allows local attackers to gain elevated privileges through improper validation of the LANG environment variable. CVSS Base Score: 8.8 CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Scope of Impact Affected Product: IBM i Affected Versions: - 7.6 (5770-SS1 Option 33) - 7.5 (5770-SS1 Option 33) - 7.4 (5770-SS1 Option 33) - 7.3 (5770-SS1 Option 33) Remediation Recommendation: IBM strongly recommends resolving this vulnerability immediately. Fix PTFs: - IBM i 7.6: PTF Number S310846, Download Link: https://www.ibm.com/mysupport/fix-information?legacy=s310846 - IBM i 7.5: PTF Number S310847, Download Link: https://www.ibm.com/mysupport/fix-information?legacy=s310847 - IBM i 7.4: PTF Number S310852, Download Link: https://www.ibm.com/mysupport/fix-information?legacy=s310852 - IBM i 7.3: PTF Number S310854, Download Link: https://www.ibm.com/mysupport/fix-information?legacy=s310854 Additional Information Workarounds and Mitigations: None References: - Complete CVSS v3 Guide - On-line Calculator v3 Related Information: - IBM Secure Engineering Web Portal - IBM Product Security Incident Response Blog Disclaimer According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an open industry standard intended to convey vulnerability severity and help prioritize response efforts. IBM provides CVSS scores “as is” and makes no express or implied warranties. Customers are responsible for evaluating the impact of vulnerabilities on their environment. IBM periodically updates component records in its product portfolio and addresses related vulnerabilities, regardless of the CVE date. Inclusion of an older CVEID does not indicate that the product has been used by IBM since that date, nor does it indicate that IBM was aware of the vulnerability prior to that date. We are working to make customers aware of relevant vulnerabilities we are aware of. Change History Initial Release Date: August 11, 2026 Cross-Reference Information Products: - IBM i - IBM i 7.3 Preventative Service Planning - IBM i 7.4 Preventative Service Planning - IBM i 7.5 Preventative Service Planning - IBM i 7.6 Preventative Service Planning Summary This security bulletin describes a vulnerability in IBM i’s PASE that allows local attackers to gain elevated privileges through improper validation of the LANG environment variable. The affected products and versions are listed, along with corresponding fix PTFs and download links. IBM strongly recommends that users apply these fixes immediately to remediate the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

IBM i PASE Privilege Escalation via LANG Env Var Validation Issue (CVE-2026-16987)