[NEW] [high] IBM i: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities in IBM i allow attackers to escalate privileges, cause denial of service, disclose information, conduct cross-site scripting and SQL injection attacks, and execute arbitrary code.

Who is affected

IBM i systems of unspecified versions are affected.

Urgency

High urgency; privilege escalation and code execution capabilities combined with multiple attack vectors present severe risk.

Action

Update IBM i to a version patching CVE-2026-16674, CVE-2026-16692, CVE-2026-16694, CVE-2026-16815, CVE-2026-16853, CVE-2026-16856, CVE-2026-16858, and CVE-2026-16859.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-08-14

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2820

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-166740.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-166920.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-166940.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-168150.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-168530.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-168560.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-168590.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-168610.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-168670.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.

Referenced CVEs

+12 more CVEs referenced in this advisory.

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• mediumCVE-2026-18020: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to…nvd
• mediumCVE-2026-17649: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due…nvd
• highCVE-2026-17502: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to…nvd
• mediumCVE-2026-17476: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to…nvd
• mediumCVE-2026-17438: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or m…nvd
• mediumCVE-2026-17226: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive i…nvd
• mediumCVE-2026-17216: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to…nvd
• mediumCVE-2026-17212: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to…nvd
• mediumCVE-2026-17088: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive i…nvd
• mediumCVE-2026-17078: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to…nvd
• mediumCVE-2026-17077: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to…nvd
• mediumCVE-2026-17076: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to…nvd

Recent advisories for IBM i

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• highCVE-2026-18554: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain s…nvd · 2026-08-14
• mediumCVE-2026-18178: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete a…nvd · 2026-08-14
• mediumCVE-2026-17227: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass s…nvd · 2026-08-14
• mediumCVE-2026-17209: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute …nvd · 2026-08-14
• criticalCVE-2026-17186: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL c…nvd · 2026-08-14
• criticalCVE-2026-17184: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code…nvd · 2026-08-14

More from CERT-Bund (BSI) Security Advisories

• high[NEW] [high] GStreamer: Multiple Vulnerabilities2026-08-17
• high[NEW] [high] Golang Go: Multiple vulnerabilities2026-08-17
• medium[NEW] [medium] Apache Struts: Multiple vulnerabilities2026-08-17
• high[NEW] [high] PostgreSQL: Multiple vulnerabilities2026-08-17
• high[UPDATE] [high] Oracle PeopleSoft: Multiple Vulnerabilities2026-08-17