CVE-2026-16892: IBM i Authentication Bypass Vulnerability

CVE-2026-16892 Overview

CVE-2026-16892 is an authentication weakness in IBM i that permits a remote authenticated attacker to bypass security restrictions. The flaw resides in the service-name matching logic, where improper authentication handling allows an attacker with valid low-privilege credentials to access resources beyond their intended scope. IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected. The issue is classified under [CWE-287: Improper Authentication].

Critical Impact
A low-privileged authenticated user can bypass service-level access controls on IBM i systems, exposing restricted services and data across all currently supported IBM i releases.

Affected Products

IBM i 7.3
IBM i 7.4
IBM i 7.5
IBM i 7.6

Discovery Timeline

2026-09-04 - CVE-2026-16892 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-16892

Vulnerability Analysis

The vulnerability stems from improper authentication during service-name matching within IBM i. When the operating system evaluates an inbound request against configured service names, the matching logic does not correctly enforce authentication boundaries. An attacker who already holds valid credentials can leverage this weakness to reach services that should require stronger authentication or a different authorization context.

Because the attack originates over the network and requires only low privileges with no user interaction, exploitation can be scripted against exposed IBM i endpoints. The impact is limited to confidentiality and integrity at a low level, with no availability impact reported. The EPSS model currently estimates a low near-term likelihood of exploitation.

Root Cause

The root cause is a logic flaw in how service-name strings are matched during the authentication step. Insufficient validation allows a request to be associated with a service the caller is not entitled to invoke. This maps directly to [CWE-287], where the authentication mechanism fails to correctly verify the identity or entitlement of the requester before granting access.

Attack Vector

Exploitation requires network access to an IBM i system and valid user credentials. The attacker submits crafted requests whose service-name field is interpreted by the matching routine in a way that bypasses the intended authentication check. No client-side interaction from another user is required. Refer to the IBM Support advisory for vendor-supplied technical detail.

No public proof-of-concept, exploit code, or exploitation in the wild has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-16892

Indicators of Compromise

Authentication events showing successful access by low-privileged users to services they have never previously invoked.
Repeated connection attempts to IBM i host servers with unusual or malformed service-name values.
Audit journal entries (QAUDJRN) showing authority failures immediately followed by successful access from the same user profile.

Detection Strategies

Enable and review IBM i security auditing with QAUDLVL values including *AUTFAIL and *NETCMN to capture authentication and network activity.
Baseline normal service-name usage per user profile, then alert on deviations that indicate service enumeration or bypass attempts.
Correlate host server job logs (QZDASOINIT, QRWTSRVR, and related prestart jobs) with user profile activity to spot access patterns inconsistent with the user's role.

Monitoring Recommendations

Forward IBM i audit journal entries to a centralized SIEM or data lake for cross-source correlation and long-term retention.
Monitor for privilege changes on user profiles and unexpected use of *ALLOBJ or service-related special authorities.
Track outbound activity from IBM i partitions to detect lateral movement following credential misuse.

How to Mitigate CVE-2026-16892

Immediate Actions Required

Apply the fixes referenced in the IBM Support advisory for IBM i 7.3, 7.4, 7.5, and 7.6.
Audit user profiles for excessive special authorities and remove entitlements that are not required for job function.
Restrict network access to IBM i host servers so that only trusted management networks can reach service ports.
Rotate credentials for any user profile that shows anomalous activity in audit logs since the disclosure date.

Patch Information

IBM has published remediation guidance at the vendor advisory: IBM Support node 7285843. Administrators should review the advisory for the specific PTF (Program Temporary Fix) identifiers applicable to each affected release and apply them through standard IBM i PTF installation procedures.

Workarounds

Use IBM i exit programs on host server exit points to enforce additional authentication and service-name validation until PTFs are applied.
Limit inbound connectivity to IBM i services using network segmentation and firewall rules that restrict access to authenticated administrative subnets.
Enforce strong password policies and enable multi-factor authentication in front of IBM i services where supported.

bash

# Example: enable relevant IBM i auditing to surface bypass attempts
CHGSYSVAL SYSVAL(QAUDCTL) VALUE('*AUDLVL *OBJAUD')
CHGSYSVAL SYSVAL(QAUDLVL) VALUE('*AUTFAIL *NETCMN *SECURITY')

# Review recent authority failures from the audit journal
DSPJRN JRN(QAUDJRN) JRNCDE((T)) ENTTYP(AF PW)