CVE-2026-16694

MediumCVSS 6.4

Published: 12/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 12/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

IBM i versions 7.6, 7.5, 7.4, and 7.3 are vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI, potentially leading to credentials disclosure within a trusted session.

Risk Assessment

An attacker could exploit this to steal credentials or perform unauthorized actions within a trusted session.

Recommendation

Apply fixes from IBM for IBM i to address the stored XSS vulnerability and secure the web interface.

Original NVD description (English source)

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.