Threat database

CVE-2026-16967 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a time-of-check to time-of-use (TOCTOU) race condition related to symbolic links, which could allow a remote authenticated attacker to gain unauthorized access to system objects. The vulnerability has a CVSS score of 8.5, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet.

IBM i versions 7.4, 7.5, and 7.6 are affected by a SQL injection vulnerability (CWE-89) that allows a remote attacker with low privileges to execute specially crafted SQL commands. This could enable unauthorized viewing, addition, modification, or deletion of data in the backend database. The vulnerability has a high severity with a CVSS score of 7.6. No official patch or remediation guidance has been provided yet.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a path traversal vulnerability (CWE-22) that could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects. This vulnerability has a high severity with a CVSS score of 8.5, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet.

IBM i versions 7.3, 7.4, 7.5, and 7.6 contain a vulnerability that allows a local authenticated attacker to change the ownership of arbitrary files. This occurs due to improper validation of an attacker-controlled file path, potentially leading to high impact on confidentiality, integrity, and availability.

CVE-2026-16896 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a time-of-check to time-of-use (TOCTOU) race condition that could allow a local authenticated attacker to gain unauthorized access to files. The vulnerability does not have a confirmed patch or remediation level as of the published date. No known exploits are reported in the wild.

IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

CVE-2026-16878 is an out-of-bounds read vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It allows a remote authenticated attacker to obtain sensitive information. The vulnerability has a medium severity with a CVSS score of 5.4. No official patch or remediation guidance has been provided yet.

CVE-2026-16871 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a heap buffer overflow that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability and requires low attack complexity with no user interaction. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-16868 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves the use of uninitialized memory during ASN.1 length processing, which could allow a remote attacker to cause a denial of service. The vulnerability is related to CWE-908 (Use of Uninitialized Resource). No official patch or remediation guidance is currently available.

CVE-2026-16867 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves improper authentication during NTLM session negotiation, allowing a remote attacker to access server resources with the privileges of an authenticated user. The vulnerability has a CVSS score of 8.1, indicating significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

CVE-2026-16859 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a remote attacker to obtain sensitive information due to an out-of-bounds read.

CVE-2026-16853 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6 that allows a remote attacker to perform an out-of-bounds read, potentially exposing sensitive information. The vulnerability does not require privileges or user interaction and impacts confidentiality and availability. No official patch or remediation guidance has been provided yet.

CVE-2026-16815 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a stack-based buffer overflow that could allow a remote attacker to cause a denial of service and potentially obtain sensitive information.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management.

IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address.

CVE-2026-16692 is a medium severity vulnerability affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a stack-based buffer overflow that could be exploited by a remote authenticated attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but can disrupt availability. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-16674 is a high-severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves an untrusted search path issue that could allow a remote authenticated attacker to execute arbitrary code. The vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet.

IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 on Windows are vulnerable to arbitrary code execution due to an untrusted search path caused by a publicly writable directory when installed for all users. This vulnerability allows a local attacker with limited privileges to execute code with the privileges of the user running the application. The vulnerability is tracked as CVE-2026-14875 and has a high severity rating with a CVSS score of 7.3.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 are affected by an authentication bypass vulnerability when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled. This vulnerability allows unauthenticated attackers to access critical functions without proper authentication.