CVE-2026-16860 is a critical (CVSS 9.9) uncontrolled search path flaw in IBM i 7.3, 7.4, 7.5 and 7.6. A remote authenticated user can run arbitrary code. IBM lists no workaround. The fix is the PTF for your release under license program 5770-SS1, so apply it and review who holds sign-on rights.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, in the base operating system (5770-SS1). IBM's security bulletin was first published on 11 August 2026.
IBM lists fixes as PTFs for license program 5770-SS1:
- IBM i 7.6: PTF SJ10879
- IBM i 7.5: PTF SJ10880
- IBM i 7.4: PTF SJ10881
- IBM i 7.3: PTF SJ10882
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770SS1) SELECT(SJ10879)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. Also review which user profiles can sign on remotely, because the flaw needs a valid account.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- Review user profiles with remote sign-on access and disable the ones that are no longer needed.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-427 (Uncontrolled Search Path Element). When a program looks for a library or file along a path that a user can influence, it may load the attacker's version in place of the real one. IBM says a remote authenticated user can use this to execute arbitrary code.
The vector shows low privileges, no user interaction and a changed scope, which is why the score is 9.9. On IBM i, this makes ordinary sign-on accounts matter. A user who should only run reports could end up running something much more powerful. CISA does not list this CVE as known exploited.
Quick check
The attacker must be authenticated. Is that low risk?
Not if you have many accounts, shared accounts or accounts with weak passwords. The vector rates privileges required as low, so any valid sign-on may be enough.
Sources
Last reviewed: 19 October 2026.
