CVE-2026-16693: IBM i Information Disclosure Vulnerability

CVE-2026-16693 Overview

CVE-2026-16693 affects IBM i versions 7.3, 7.4, 7.5, and 7.6. The vulnerability allows a remote authenticated attacker with high privileges to obtain sensitive information. The root cause is the use of hardcoded cryptographic constants to obfuscate encryption keys, classified under [CWE-327] Use of a Broken or Risky Cryptographic Algorithm. An attacker who understands the obfuscation scheme can reverse it to recover the underlying encryption keys and access protected data.

Critical Impact
Authenticated attackers can recover obfuscated encryption keys and disclose sensitive information stored or transmitted by affected IBM i systems.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-16693 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-16693

Vulnerability Analysis

The vulnerability resides in an IBM i cryptographic routine that protects encryption keys through obfuscation rather than through a proper key-wrapping mechanism. The obfuscation relies on constants embedded directly in the software binary. Because these constants are static across installations, any attacker who obtains them and understands the transformation logic can reverse the process and recover the plaintext keys.

Exploitation requires network access and an authenticated session with high privileges on the target system. Successful exploitation compromises the confidentiality of data that the recovered keys protect, but does not directly impact integrity or availability.

Root Cause

The flaw is a design weakness categorized under [CWE-327]. Hardcoded cryptographic constants provide no security once disclosed through binary analysis. Secure key management requires per-installation entropy, hardware-backed key storage, or a properly derived key encryption key rather than static values shared across all deployments.

Attack Vector

An authenticated attacker with elevated privileges on the affected IBM i host can access the routines or artifacts that use the hardcoded constants. By reproducing the obfuscation algorithm offline, the attacker unwraps stored keys and decrypts sensitive material. No user interaction is required. Refer to the IBM Support Page for vendor-supplied technical details.

No public proof-of-concept or exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-16693

Indicators of Compromise

Unexpected access by privileged user profiles to cryptographic services, key stores, or system objects that reference protected keys.
Anomalous read access to IBM i library objects or program modules that implement key protection routines.
Outbound transfers of binary artifacts or key material from IBM i partitions to unusual destinations.

Detection Strategies

Audit IBM i security journal (QAUDJRN) entries for privileged profile activity involving cryptographic APIs and key management functions.
Correlate privileged authentication events with subsequent access to sensitive libraries, encrypted data stores, or backup media.
Baseline normal administrative behavior and alert on deviations by profiles holding *ALLOBJ or *SECADM authorities.

Monitoring Recommendations

Forward IBM i audit journal data to a centralized SIEM or data lake for retention and correlation with identity telemetry.
Monitor changes to user profile authorities and unexpected elevation to high-privilege classes.
Review access patterns to files, spool entries, and IFS paths that hold data protected by IBM i cryptographic services.

How to Mitigate CVE-2026-16693

Immediate Actions Required

Apply the IBM-provided fix referenced in the IBM Support Page for IBM i 7.3, 7.4, 7.5, and 7.6.
Inventory user profiles with high privileges and remove authorities that are not required for operational duties.
Rotate any encryption keys and secrets that may have been protected using the affected obfuscation routine after patching.

Patch Information

IBM has published remediation guidance and PTF availability on the vendor advisory. Administrators should consult the IBM Support Page for the specific PTF identifiers, cumulative Group PTF levels, and installation order that apply to each affected release.

Workarounds

Restrict network access to IBM i management interfaces and cryptographic services to trusted administrative networks only.
Enforce least privilege by limiting *ALLOBJ, *SECADM, and *SERVICE special authorities to a minimal set of accounts.
Enable and actively review the IBM i security audit journal for privileged account activity until patches are deployed.

bash

# Configuration example
# Review high-privilege profiles on IBM i using DSPUSRPRF
DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*OUTFILE) +
         OUTFILE(QGPL/USRPRFLST)

# Ensure the security audit journal is active and capturing
# authority, object access, and security-relevant events
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*AUTFAIL *SECURITY *SERVICE')