CVE-2026-16868 is a high severity (CVSS 8.1) flaw in IBM i 7.3, 7.4, 7.5 and 7.6, caused by use of uninitialized memory during ASN.1 length processing. IBM says a remote attacker could cause a denial of service. IBM provides PTFs under 5770-999.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, per IBM's bulletin and the NVD record. IBM lists these PTFs for 5770-999:
- IBM i 7.6: MJ10939
- IBM i 7.5: MJ10938
- IBM i 7.4: MJ10937
- IBM i 7.3: MJ10936
IBM says to address the issue now and recommends that users of unsupported IBM i releases move to a supported, fixed version.
How to check if you're exposed
IBM i 7.3 through 7.6 are all in scope, so every supported and recently supported release needs a look. On each partition, confirm the installed release and then check whether the PTF for your release is loaded. From a command line:
DSPPTF LICPGM(5770999)
Look for the PTF number listed for your release in the table above, with a status of Applied or Permanently applied. You can also use option 10 of GO LICPGM to confirm the release. Do this on every LPAR, including test and recovery systems, because they are often patched last.
What to do now
- List every IBM i partition and its release, including test and disaster recovery systems.
- Find the PTF for your release in the table above, and order it from IBM Fix Central or through your usual PTF process.
- Apply the PTF and restart as the PTF cover letter requires.
- Check the PTF status with DSPPTF and record it.
- Limit access to IBM i network services to the hosts and users that need them.
Why it matters
CWE-908 is use of an uninitialized resource. The code reads memory it never set, so its behavior depends on whatever was left there. ASN.1 is the encoding used by certificates and many network protocols, so length handling is parsed on untrusted input.
The record's description names denial of service only, but the CVSS vector rates confidentiality, integrity and availability all as high, and attack complexity as high. Both are quoted from the record and match IBM's score of 8.1. Treat the vector as the more cautious view and patch accordingly. CVE-2026-16853 is in the same bulletin.
The weakness class here is CWE-908 (Use of Uninitialized Resource). The NVD record scores it 8.1, which is high severity. IBM's bulletin gives the same score. The CVSS vector reads attack vector over the network, high attack complexity, no privileges required, no user interaction. Scope is unchanged. Impact on confidentiality, integrity and availability is rated high, high and high. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Safeguard's Gold directory tracks this CVE, and reachability analysis helps you decide which affected components matter most for your own software.
Quick check
The description says denial of service. Why is the score 8.1?
The vector rates all three impact areas as high. The text names denial of service, so there is a gap between description and score. The patch is the safe response.
Sources
- IBM security bulletin
- Safeguard Gold entry for CVE-2026-16868, which summarizes the NVD record
Last reviewed: 18 October 2026.
