CVE-2026-16987 is a high severity (CVSS 8.8) flaw in IBM i 7.3, 7.4, 7.5 and 7.6, caused by improper validation of the LANG environment variable. A local attacker could gain elevated privileges. IBM provides a PTF for each release under 5770-SS1 Option 33, and the bulletin lists the numbers.
What's affected
IBM i 7.6, 7.5, 7.4 and 7.3, per IBM's bulletin and the NVD record. IBM lists these PTFs for 5770-SS1 Option 33:
- IBM i 7.6: SJ10846
- IBM i 7.5: SJ10847
- IBM i 7.4: SJ10852
- IBM i 7.3: SJ10854
IBM says to address the issue now and recommends that users of unsupported IBM i releases move to a supported, fixed version.
How to check if you're exposed
IBM i 7.3 through 7.6 are all in scope, so every supported and recently supported release needs a look. On each partition, confirm the installed release and then check whether the PTF for your release is loaded. From a command line:
DSPPTF LICPGM(5770SS1)
Look for the PTF number listed for your release in the table above, with a status of Applied or Permanently applied. You can also use option 10 of GO LICPGM to confirm the release. Do this on every LPAR, including test and recovery systems, because they are often patched last.
What to do now
- List every IBM i partition and its release, including test and disaster recovery systems.
- Find the PTF for your release in the table above, and order it from IBM Fix Central or through your usual PTF process.
- Apply the PTF and restart as the PTF cover letter requires.
- Check the PTF status with DSPPTF and record it.
- Limit access to IBM i network services to the hosts and users that need them.
Why it matters
The record maps this to CWE-73, external control of file name or path. The LANG variable is set by the user, and when a privileged program uses it to build a path without validating it, the user can influence which file gets loaded. IBM says this leads to privilege escalation.
The vector shows local access, low complexity and low privileges, with changed scope and high impact on all three properties. Environment variables are easy to control for anyone with a shell or job context, so low complexity is believable here. Note that the affected feature is Option 33, so confirm that option is installed on your systems.
The weakness class here is CWE-73 (External Control of File Name or Path). The NVD record scores it 8.8, which is high severity. IBM's bulletin gives the same score. The CVSS vector reads attack vector with local access, low attack complexity, low privileges required, no user interaction. Scope is changed, meaning the impact can reach beyond the vulnerable component. Impact on confidentiality, integrity and availability is rated high, high and high. The record's KEV flag is false, so this CVE is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory I fetched does not report exploitation.
Try it yourself
A free in-browser dependency scan at gold.safeguard.sh/scan shows which of your components match known CVEs. The demo below walks through the idea.
Click through it at your own pace, or open it full screen.
Quick check
What is Option 33?
The bulletin lists 5770-SS1 Option 33 as the affected feature. Check whether it is installed, then apply the PTF for your release.
Sources
- IBM security bulletin
- Safeguard Gold entry for CVE-2026-16987, which summarizes the NVD record
Last reviewed: 18 October 2026.
