CVE-2026-16694: IBM i Stored XSS Vulnerability

CVE-2026-16694 Overview

CVE-2026-16694 is a stored cross-site scripting (XSS) vulnerability affecting IBM i versions 7.6, 7.5, 7.4, and 7.3. An authenticated user can embed arbitrary JavaScript into the Web UI, altering intended functionality and potentially exposing credentials within a trusted session. The flaw is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers can inject persistent JavaScript into the IBM i Web UI, enabling credential theft and session manipulation against any user who views the affected page.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-08-12 - CVE-2026-16694 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-16694

Vulnerability Analysis

The vulnerability is a stored cross-site scripting weakness in the IBM i Web UI. IBM i fails to properly neutralize user-supplied input before rendering it back to the browser. An authenticated attacker can submit crafted input containing JavaScript, which the application stores server-side and later reflects into pages served to other users.

Because the injected script executes in the context of the trusted Web UI, it inherits the origin and session privileges of the viewing user. This enables theft of session tokens, credentials entered into forms, and unauthorized actions initiated on behalf of the victim. The scope change reflected in the CVSS metrics indicates that a successful exploit affects components beyond the vulnerable one, consistent with browser-side execution against a different security context.

Root Cause

The root cause is missing or insufficient output encoding when the IBM i Web UI renders stored user-controlled content. Input that should be treated as inert text is instead interpreted as executable markup by the browser, satisfying the conditions for [CWE-79].

Attack Vector

Exploitation requires network access to the IBM i Web UI and low-privilege authenticated access. The attacker submits a payload containing JavaScript through a Web UI input that lacks proper sanitization. The payload is persisted in the application and later delivered to any user, including administrators, who accesses the affected view. No user interaction is required to trigger the stored payload beyond loading the affected page.

See the IBM Support Page for CVE-2026-16694 for vendor-specific technical details.

Detection Methods for CVE-2026-16694

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror or onload, or encoded JavaScript payloads stored in IBM i Web UI database fields.
Outbound HTTP requests from user browsers to unfamiliar domains shortly after loading IBM i Web UI pages.
Anomalous session activity or credential submissions originating from administrator accounts using the Web UI.

Detection Strategies

Review web server and application logs for POST requests containing HTML or JavaScript syntax in fields not expected to accept markup.
Inspect stored records in IBM i Web UI data stores for content matching XSS payload patterns such as <script>, javascript:, or base64-encoded scripts.
Correlate authentication events with subsequent unusual administrative actions that may indicate hijacked sessions.

Monitoring Recommendations

Enable verbose HTTP request logging on the IBM i Web UI and forward logs to a centralized analytics platform for pattern matching.
Alert on Content Security Policy (CSP) violation reports if CSP headers are deployed in front of the Web UI.
Monitor privileged account activity in the Web UI for behavioral deviations consistent with session hijacking.

How to Mitigate CVE-2026-16694

Immediate Actions Required

Apply the IBM-provided fix referenced in the IBM Support Page for CVE-2026-16694 to all affected IBM i 7.6, 7.5, 7.4, and 7.3 systems.
Restrict Web UI access to trusted administrative networks until patches are deployed.
Audit existing Web UI data stores for previously injected payloads and remove any malicious content.

Patch Information

IBM has published remediation guidance on its support portal. Refer to the IBM Support Page for CVE-2026-16694 for the specific PTFs and update procedures applicable to each affected IBM i release.

Workarounds

Limit Web UI access to a minimal set of authenticated users while patching is scheduled.
Deploy a reverse proxy or web application firewall in front of the IBM i Web UI to filter payloads containing HTML or JavaScript in unexpected fields.
Enforce a strict Content Security Policy that disallows inline script execution to reduce the impact of stored payloads.

bash

# Example restrictive Content Security Policy header for a reverse proxy fronting the IBM i Web UI
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'";