CVE-2026-16693: CWE-327 Use of a Broken or Risky Cryptographic Algorithm

CVE-2026-16693 affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The vulnerability arises from the use of hardcoded cryptographic constants to obfuscate encryption keys, which is considered a broken or risky cryptographic practice (CWE-327). This flaw could allow a remote attacker with authenticated access and high privileges to obtain sensitive information. The CVSS 3.1 base score is 4.4, with attack vector local, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality impact. No vendor advisory or patch information is currently available.

An attacker with remote authenticated access and high privileges could exploit this vulnerability to obtain sensitive information due to weak cryptographic protections. The integrity and availability of the system are not impacted. The confidentiality impact is high, but exploitation requires elevated privileges and local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users with high privileges and monitor for unauthorized access attempts. Avoid relying on the affected cryptographic mechanisms where possible.