CVE-2026-16674

This CVE represents a critical failure in IBM i's library loading mechanism—an untrusted search path that enables arbitrary code execution rather than mere privilege escalation. That distinction matters. On most platforms, library hijacking means owning a single process. On IBM i, it means potentially reaching financial clearing interfaces, EHR integrations, and manufacturing execution systems under a credential hygiene model that's critically weak. The CVSS 8.8 score is misleading. The 'authenticated attacker' requirement assumes meaningful access control, but IBM i environments notoriously run static passwords rarely rotated, shared service accounts with excessive privileges, and authentication mechanisms predating modern threat models. 'Authenticated' on these systems often just means 'got past a password unchanged since 2019.' An attacker compromising a single application account can leverage this for lateral movement into systems where that credential has far broader access than it should. The version spread across 7.3 through 7.6 reveals accumulated technical debt, not a fresh introduction. Either the vulnerable code path predates current security assumptions, or configuration drift has normalized unsafe library resolution behaviors. Either way, IBM i shops patch on extended cycles due to operational risk concerns—this leaves a high-severity, easily weaponized flaw active on critical infrastructure for months. Your priority: treat this as immediately exploitable despite the 'authenticated' qualifier. Inventory all service accounts, application credentials, and shared profiles with broad library access. Identify library search paths that resolve from user-controlled or world-writable directories. Review any third-party or custom software that modifies the library loading behavior—these are the most likely introduce the vulnerable resolution logic. The exploit requires no sophistication, only patience: the resolution happens silently at load time with no runtime verification. If an attacker has any foothold, they'll find the moment when the vulnerable search path resolves.

Reviewed through automated stages and approved by a human before publication.