This vulnerability (CVE-2026-16896) affects IBM i operating system versions 7.3 through 7.6. It is classified as a CWE-367 TOCTOU race condition, where a local authenticated attacker might exploit the timing gap between checking a resource and using it to access files without proper authorization. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability. No official patch or remediation guidance is currently provided by the vendor, and no exploits are known in the wild.

Successful exploitation could allow a local authenticated attacker to access files they are not authorized to, potentially leading to unauthorized disclosure and modification of sensitive information. There is no indication of impact on system availability. The vulnerability requires local access and some privileges, limiting remote exploitation possibilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity related to file access. Follow IBM's official communications for updates on patches or mitigations.