Security readout for executives and security teams
Plain-English summary
IBM i versions 7.3 through 7.6 contain a critical flaw that may let a remote, authenticated user run arbitrary code. Successful exploitation could seriously compromise sensitive data and system integrity, with some availability impact. Authentication is required, but only low privileges are indicated.
Executive priority
Treat as an urgent remediation item because exploitation could enable broad code execution and substantial confidentiality and integrity loss. Prioritize internet-reachable, partner-accessible, and credential-exposed systems, while confirming exact fix requirements through IBM's advisory.
Technical view
CVE-2026-16860 is an uncontrolled search path element vulnerability, CWE-427. Its CVSS 3.1 score is 9.9: network-accessible, low complexity, low privileges, no user interaction, and changed scope, with high confidentiality and integrity impact and low availability impact.
Likely exposure
Organizations operating IBM i 7.3, 7.4, 7.5, or 7.6 are potentially exposed, particularly where untrusted or compromised accounts can reach affected services. The supplied sources do not identify specific services, configurations, or prerequisites beyond remote authenticated access.
Exploitation context
The supplied bundle does not establish active exploitation, and the CVE is not identified as CISA KEV-listed. Exploitation requires authentication but is rated low complexity and low privilege, making compromised credentials or malicious insiders relevant risk scenarios.
Researcher notes
Public details in the supplied bundle are limited to the affected releases, CWE, CVSS vector, and IBM advisory reference. They do not identify the vulnerable component, executable search path, attack prerequisites beyond authentication, indicators of compromise, or release-specific fixes. Avoid assuming broader product or configuration impact.
Mitigation direction
- Review IBM advisory 7283282 for release-specific remediation and applicability details.
- Apply IBM-provided fixes according to the advisory and organizational change controls.
- Restrict remote access to affected IBM i systems while remediation is pending.
- Review and minimize privileges for accounts able to access affected systems.
Validation and detection
- Inventory IBM i systems and confirm whether versions 7.3 through 7.6 are present.
- Compare installed fix levels with the release-specific requirements in IBM advisory 7283282.
- Verify remote access is limited to authorized users and trusted network paths.
- Review security records for suspicious authenticated activity or unexpected code execution.
- Retest affected systems after remediation without using production-impacting techniques.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-427: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-16860 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L3.16ibmVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/7283282CVE reference, ibm · vendor-advisory, patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Search Path Element
Uncontrolled Search Path Element represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.