CVE-2026-16867 is a high severity (CVSS 8.1) improper authentication flaw in IBM i NetServer. During NTLM session negotiation, a remote attacker could access server resources with the privileges of an authenticated user. IBM published PTFs for IBM i 7.3 to 7.6 under license program 5770-999.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, in NetServer, the IBM i file and print sharing service. IBM's security bulletin was first published on 12 August 2026.
IBM lists fixes as PTFs for license program 5770-999:
- IBM i 7.6: PTF MJ10939
- IBM i 7.5: PTF MJ10938
- IBM i 7.4: PTF MJ10937
- IBM i 7.3: PTF MJ10936
IBM lists no workaround or mitigation for this issue. IBM also says to move off any unsupported release to a supported and fixed one.
How to check if you're exposed
Find your release and check whether the PTF for it is applied. On the IBM i command line, display the PTF status with the CL command below, using the PTF ID from the list above for your release.
DSPPTF LICPGM(5770999) SELECT(MJ10939)
A PTF that shows as permanently or temporarily applied counts as installed. One that is missing or only loaded needs action. Check that the NetServer job is not reachable from networks that have no need for file shares.
What to do now
- Identify every IBM i partition, including development and recovery systems, and record its release.
- Order and apply the PTF for your release from the table above, using IBM Fix Central or your usual PTF process.
- Limit which networks can reach NetServer ports until the PTF is in place.
- Confirm the PTF status again after the IPL, if one is required, and keep the result for your records.
Why it matters
The weakness is CWE-287 (Improper Authentication). IBM says the NTLM session negotiation in NetServer did not authenticate properly, so a remote attacker could use server resources as if they were an authenticated user. The vector marks attack complexity as high, which suggests specific conditions must hold.
NetServer is how Windows clients reach IBM i shares. If it is open to wide networks, the exposure grows. IBM names confidentiality, integrity and availability impact as high. CISA does not list this CVE as known exploited.
Quick check
What is NetServer?
It is the IBM i service that lets Windows and other SMB clients use IBM i file shares and printers.
Sources
Last reviewed: 19 October 2026.
