CVE-2026-16908 is a path traversal vulnerability affecting IBM i versions 7.3 through 7.6. It allows a remote attacker with authentication privileges to bypass pathname restrictions and access arbitrary objects on the system. The vulnerability is classified under CWE-22 and has a CVSS 3.1 base score of 8.5, reflecting high impact on confidentiality, integrity, and availability. As of the published date, no vendor advisory or patch information is available, and the remediation level is unknown.

An authenticated remote attacker could exploit this vulnerability to access arbitrary objects beyond intended directory restrictions, potentially leading to unauthorized disclosure, modification, or deletion of sensitive data. The CVSS vector indicates high complexity (AC:H) and low privileges required (PR:L), with no user interaction needed (UI:N). The impact affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote authenticated access to trusted users only and monitor for unusual activity related to file access. Avoid exposing vulnerable IBM i interfaces to untrusted networks.