CVE-2026-16860: IBM i RCE Vulnerability via Search Path

CVE-2026-16860 Overview

CVE-2026-16860 affects IBM i versions 7.6, 7.5, 7.4, and 7.3. The vulnerability permits a remote authenticated attacker to execute arbitrary code because of an uncontrolled search path element [CWE-427]. An attacker with valid credentials can leverage the flaw to load attacker-controlled code into a trusted process context. Successful exploitation can result in code execution across the system boundary, expanding impact beyond the initially compromised component.

Critical Impact
Remote authenticated attackers can execute arbitrary code on affected IBM i systems, with a scope-changed impact reaching confidentiality and integrity of adjacent components.

Affected Products

IBM i 7.6
IBM i 7.5
IBM i 7.4
IBM i 7.3

Discovery Timeline

2026-08-12 - CVE CVE-2026-16860 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-16860

Vulnerability Analysis

The vulnerability is classified under CWE-427: Uncontrolled Search Path Element. This weakness occurs when an application resolves library, binary, or module locations using a search path that includes directories writable by lower-privileged users. When a privileged process loads a dependency by name rather than by absolute path, the operating system walks the configured search path and loads the first matching artifact.

An authenticated attacker who can place a malicious file into a directory that appears earlier in the resolution order can substitute their own code for a legitimate dependency. The privileged process then executes attacker-controlled logic under its own security context. The scope change reflected in the CVSS vector indicates the attacker's impact extends beyond the vulnerable component into other parts of the IBM i system.

Root Cause

The root cause is IBM i resolving one or more program or library references through a search path that is not fully controlled by the trusted component. Directories reachable by an authenticated user precede or shadow trusted locations during resolution.

Attack Vector

Exploitation requires network access and a valid authenticated session on the IBM i system. The attacker stages a malicious library or program in a search-path location and triggers the affected functionality. When the vulnerable process loads the dependency, the malicious artifact executes with the process's privileges. No user interaction is required.

For technical specifics, refer to the IBM Security Advisory.

Detection Methods for CVE-2026-16860

Indicators of Compromise

Unexpected program or service program objects placed in library-list directories writable by non-administrative user profiles.
Job logs showing privileged processes resolving *PGM or *SRVPGM objects from unexpected libraries earlier in the library list.
Creation of new objects in QSYS search-path libraries by user profiles without administrative authority.

Detection Strategies

Audit library lists (*LIBL) and system values QSYSLIBL and QUSRLIBL for entries that grant *CHANGE or *ALL authority to interactive users.
Enable IBM i security auditing (QAUDLVL) with *CREATE and *OBJMGT values to record object creation and modification in trusted libraries.
Correlate authentication events with subsequent object creation to identify staging behavior consistent with search-path hijacking.

Monitoring Recommendations

Forward IBM i audit journal (QAUDJRN) entries to a centralized SIEM for continuous review.
Alert on any addition of *PGM, *SRVPGM, or *CMD objects to system libraries outside of change-management windows.
Track anomalous invocation of privileged programs immediately following library-list modifications.

How to Mitigate CVE-2026-16860

Immediate Actions Required

Apply the IBM-provided fixes referenced in the IBM Security Advisory for IBM i 7.6, 7.5, 7.4, and 7.3.
Inventory user profiles with authority to modify libraries appearing in system and user library lists and remove unnecessary write permissions.
Restrict authenticated network access to IBM i services to trusted administrative networks only.

Patch Information

IBM has published remediation guidance in its security bulletin. Administrators should consult the IBM Security Advisory for the specific PTF (Program Temporary Fix) group and version required for each affected release of IBM i.

Workarounds

Remove *CHANGE and *ALL public authority from libraries referenced by privileged processes and enforce *USE where possible.
Reorder library lists so trusted system libraries are resolved before any user-writable libraries.
Limit authenticated access to the IBM i host through network segmentation and enforce least privilege on service accounts used for automation.

bash

# Configuration example: reduce public authority on a library referenced in the search path
RVKOBJAUT OBJ(QSYS/USRLIB) OBJTYPE(*LIB) USER(*PUBLIC) AUT(*ALL)
GRTOBJAUT OBJ(QSYS/USRLIB) OBJTYPE(*LIB) USER(*PUBLIC) AUT(*USE)

# Enable auditing for object creation and management events
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*CREATE *OBJMGT *SECURITY')