IBM i versions 7.3 through 7.6 contain an improper authentication vulnerability (CWE-287) during NTLM session negotiation. This flaw could allow a remote attacker to gain access to server resources with the privileges of an authenticated user, bypassing normal authentication controls. The vulnerability is publicly documented as CVE-2026-16867 with a CVSS 3.1 base score of 8.1, reflecting high impact and network attack vector with no privileges or user interaction required. No vendor remediation or patch information is currently available, and no active exploitation has been reported.

Successful exploitation allows a remote attacker to access server resources with the privileges of an authenticated user, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized data access, modification, or disruption of services on IBM i systems running the affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor IBM's security advisories for updates. No vendor-provided temporary mitigations or workarounds are currently documented.