CVE-2026-16904 is a vulnerability in IBM i versions 7.3 through 7.6 caused by improper privilege management during the reassignment of monitor ownership. This weakness could permit a remote attacker with valid authentication to execute arbitrary commands, potentially compromising system confidentiality and integrity. The CVSS v3.1 base score is 8.1, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity. As of the published date, no official remediation or patch has been documented.

A remote authenticated attacker can execute arbitrary commands on affected IBM i systems, potentially leading to unauthorized access and control over sensitive data and system functions. The vulnerability impacts confidentiality and integrity but does not affect availability. This could result in significant security breaches if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should limit remote authenticated access to trusted users and monitor for unusual command execution patterns related to monitor owner reassignment. Follow IBM's official channels for updates on patches or mitigations.