Loading story…
IBM disclosed that IBM i NetServer is affected by 15 vulnerabilities across versions 7.3, 7.4, 7.5, and 7.6, with impacts including sensitive information disclosure, denial of service, and unauthorized access to server resources. The bulletin describes multiple weakness classes, including out-of-bounds read (CWE-125), out-of-bounds write, integer overflow, incomplete bounds checking, improper authentication, heap buffer overflow, and use of uninitialized memory. IBM said the most severe issues reach CVSS 8.6 and that no workarounds or mitigations are available.
Among the newly tracked issues, CVE-2026-16867 affects NTLM session negotiation and could let a remote attacker access server resources with the privileges of an authenticated user, while CVE-2026-16868 could allow a remote denial-of-service condition through uninitialized memory during ASN.1 length processing. IBM directed customers to apply fixes delivered in PTFs MJ10936 through MJ10939 to address the NetServer flaws.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-16868 states that psirt@us.ibm.com received the vulnerability on August 13, 2026. The issue involves use of uninitialized memory during ASN.1 length processing and could allow a remote attacker to cause a denial of service.
The CVE record for CVE-2026-16867 states that IBM PSIRT received the vulnerability on August 13, 2026. The flaw is an improper authentication issue during NTLM session negotiation that can let a remote attacker access server resources with an authenticated user's privileges.
IBM published a security bulletin stating that IBM i NetServer is affected by 15 vulnerabilities impacting IBM i versions 7.3, 7.4, 7.5, and 7.6. IBM released fixes via PTFs MJ10936 through MJ10939 and said no workarounds or mitigations are available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceibm.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
IBM disclosed a broad set of vulnerabilities affecting **IBM i** versions `7.3` through `7.6`, with the most serious issues enabling remote code execution, privilege escalation, and security bypass. In **Navigator for i**, IBM reported multiple flaws including improper authorization, command injection, XML injection, unsafe reflection, and improper privilege management. The highest-rated Navigator issue, `CVE-2026-17276` (**CVSS 9.6**), could let a remote authenticated attacker escalate privileges through high-authority thread handling, while `CVE-2026-18235` could allow authenticated execution of arbitrary Control Language commands and `CVE-2026-17095` could permit restriction bypass. IBM also tied the bulletin to additional high-severity weaknesses such as `CVE-2026-16904` and `CVE-2026-18098`, which could enable arbitrary command execution or expose sensitive information. Separate IBM i flaws addressed in the same patch cycle include `CVE-2026-16860`, a **CVSS 9.9** uncontrolled search path issue that could lead to remote code execution with low-privileged access, and `CVE-2026-17083`, a **CVSS 9.8** unauthenticated stack-based buffer overflow in the **IBM i Debug Server** that could enable remote code execution. IBM released fixes through PTFs **SJ10887**, **SJ10888**, **SJ10890**, and **SJ10891**, said no workarounds or mitigations were available for the Navigator for i bulletin, and urged customers to apply the updates immediately or move unsupported systems to fixed supported releases. Reporting on the release said there was no known active exploitation at publication, but warned that exposed Debug Server instances and enterprise IBM i systems running payroll, ERP, supply chain, and financial workloads face elevated risk until patched.
Aug 13, 2026
IBM disclosed multiple vulnerabilities in **WebSphere Application Server** and **WebSphere Application Server Liberty**, including denial-of-service issues tracked as `CVE-2026-9071` and `CVE-2026-9320`, and an HTTP request smuggling flaw, `CVE-2026-8646`, rated up to **CVSS 8.1**. The affected products include WebSphere Application Server **8.5** and **9.0**, along with WebSphere Liberty versions **17.0.0.3 through 26.0.0.6** when certain servlet or websocket features are enabled. IBM said no workarounds or mitigations are available and advised customers to apply interim fixes for **APAR PH71631** and **PH71370** or upgrade to fix packs **26.0.0.7**, **9.0.5.29**, or **8.5.5.30**. A related high-severity issue, `CVE-2026-9072`, affects **IBM i 7.3 through 7.6** in environments using WebSphere Application Server or Liberty with **Intelligent Management** and the **WebSphere WebServer Plug-in**. IBM said an attacker who can impersonate backend servers and send crafted responses to the plug-in could trigger **remote code execution** and **denial of service**, also with a **CVSS 8.1** rating. Recommended actions include installing the latest WebSphere security updates, updating IBM i to current levels, and reviewing the secure configuration of Intelligent Management and the WebSphere WebServer Plug-in.
Jun 29, 2026
IBM disclosed multiple high-severity vulnerabilities affecting **WebSphere** and **webMethods Integration Server**, exposing enterprise middleware environments to remote compromise. In WebSphere, the reported issues include remote code execution flaws tracked as `CVE-2026-9311`, `CVE-2026-9330`, and `CVE-2026-9319`, alongside an authentication bypass and identity spoofing issue, `CVE-2026-8644`. Affected deployments include traditional WebSphere versions **9.0** and **8.5**, with IBM issuing interim fixes through specific APARs and urging administrators to verify configurations and apply patches quickly. A separate IBM advisory covers **webMethods Integration Server** `CVE-2025-36072`, a deserialization-based remote code execution flaw that can be exploited by an authenticated attacker with service execution privileges through internal APIs or protocols such as `IDataBin`. The vulnerability affects versions **10.11** through `10.11_Core_Fix22`, **10.15** through `10.15_Core_Fix22`, and **11.1** through `11.1_Core_Fix6` if they have not received the latest core fixes. Successful exploitation could allow arbitrary code execution in the Integration Server process, enabling lateral movement, persistence, and data exfiltration across business-critical systems.
Jun 29, 2026