CVE-2026-16904

IBM i versions 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server. This vulnerability may lead to data disclosure or disruption of file services.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.