CVE-2026-16860

IBM i 7.3-7.6 systems allow remote authenticated attackers to execute arbitrary code via an uncontrolled search path element.

This critical RCE vulnerability in IBM i operating systems enables attackers with valid credentials to execute arbitrary code remotely, bypassing standard authentication controls. DIB organizations must patch IBM i systems immediately and restrict unnecessary remote access to prevent exploitation. The failure stems from an uncontrolled search path element, a classic programming oversight that allows code execution.

Shame score — A critical RCE in an enterprise operating system with a CVSS 9.9 score represents a severe, avoidable failure in secure coding and patch management that could lead to full system compromise.