Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

IBM WebSphere Application Server Liberty on IBM i - Untrusted Search Path

CVE-2026-16674 · published 2 months ago
Summary

IBM i systems running WebSphere Application Server Liberty are at risk of code execution by a remote attacker who has already authenticated. This could allow the attacker to access sensitive data or perform unauthorized actions. IBM recommends applying the latest security fixes to mitigate this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm i 7.6
7.3
7.4
7.5
Original advisory text
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path.
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-426Untrusted Search Path
Timeline
Published13 Aug 2026
Updated4 Nov 2026
First seen13 Aug 2026
Sources
CVE-2026-16674 · NVD
CVE-2026-16674 · MITRE
Track software like this
Free during beta