CVE-2026-16815 is a high severity (CVSS 8.6) stack-based buffer overflow in the IBM i Simple Mail Transfer Protocol component. A remote attacker with no login can cause a denial of service and may read some data. IBM published PTFs for IBM i 7.3 to 7.6, and the fix is to apply the one for your release.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, in the Simple Mail Transfer Protocol (SMTP) component. IBM's security bulletin was first published on 12 August 2026.
IBM lists fixes as PTFs for license program 5770-TC1:
- IBM i 7.6: PTF SJ11061 and SJ11131
- IBM i 7.5: PTF SJ11074 and SJ11129
- IBM i 7.4: PTF SJ11083 and SJ11127
- IBM i 7.3: PTF SJ11084 and SJ11123
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770TC1) SELECT(SJ11061)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. This bulletin lists two PTFs per release, so check both.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- If SMTP does not need to be reachable from other networks, limit it with firewall rules in the meantime.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-787 (Out-of-bounds Write). A stack-based buffer overflow in the SMTP code can be reached over the network with no credentials. IBM rates it as mainly an availability problem, with some confidentiality and integrity impact, and the vector marks complexity as low.
The same IBM bulletin covers two more SMTP overflows, CVE-2026-18077 and CVE-2026-16692, so one PTF set closes all three. Mail servers face other networks by design, which makes SMTP a service worth patching early. CISA does not list this CVE as known exploited.
Quick check
Do I need to patch if I do not use SMTP on IBM i?
The bulletin lists the SMTP component on all four releases. Check whether the SMTP server is running or can be started, and apply the PTF regardless so the code is fixed.
Sources
Last reviewed: 19 October 2026.
