External risk intelligence

IBM i Improper Authentication Allows Resource Access

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-16867

IBM i is an enterprise operating system typically deployed within internal data centers or protected private networks. While it may support network protocols like NTLM, it is not designed to be exposed directly to the public internet, and such exposure would generally be considered an unusual or misconfigured deployment pattern.

Authentication Bypass

Ibm I

7.37.47.57.6

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in IBM i systems that could allow unauthorized access to server resources. This issue stems from improper handling of authentication during NTLM session negotiation, potentially granting an attacker the same privileges as a legitimate user without proper validation.

Improper authentication allows unauthorized access.
Critical if your IBM i systems are internet-facing.
Confirm if this affects your environment.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by targeting the NTLM session negotiation process on an IBM i system. If successful, the attacker could gain unauthorized access to server resources, assuming the privileges of an authenticated user.

Unauthenticated network access required.
Vulnerability triggered during NTLM negotiation.
Attacker gains authenticated user privileges.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker to access sensitive server resources by impersonating an authenticated user during NTLM session negotiation. This could occur when the system is accessible over the network and NTLM authentication is utilized.

Server resources and authenticated user privileges.
Improper authentication during NTLM session negotiation.
Unauthorized access to sensitive server data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in IBM i affects systems that handle NTLM authentication, potentially exposing server resources. Ownership likely falls to infrastructure or platform teams managing the IBM i environment, in coordination with security teams. The initial step is to inventory all IBM i systems, confirm their exposure and criticality, identify accountable owners, and then prioritize remediation based on risk.

Ownership: Infrastructure and platform teams.
Verify first: System inventory and reachability.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM i?

IBM i is a secure, integrated operating system designed for enterprise-grade hardware. It serves as the foundation for high-performance business applications, hosting critical databases, transactional systems, and legacy enterprise software commonly used in banking, logistics, and supply chain operations.

What does CVE-2026-16867 mean?

This vulnerability, classified as Improper Authentication (CWE-287), occurs when a system fails to correctly verify the identity of a user. In this specific case, the IBM i operating system incorrectly handles the NTLM session negotiation process, allowing an attacker to bypass standard authentication checks and gain the access rights of a legitimate user.

How is this vulnerability triggered?

An attacker triggers this flaw by interacting with the NTLM authentication process over a network. The vulnerability relies on the system accepting manipulated session negotiations. It is important to note that this is not triggered by local console access, but requires network-based communication targeting the specific NTLM handshake mechanism.

Do I need to worry about this if my system is internal?

While the vulnerability is critical, Halo Surface Signal notes that IBM i systems are typically deployed in protected private networks or internal data centers. Because the software is not designed for public internet exposure, systems isolated from the internet are at significantly lower risk than those misconfigured to be directly accessible.

What should I do to address this risk?

Start by conducting an inventory of your environment to identify all IBM i systems and confirm their network connectivity. Once mapped, coordinate with your infrastructure and security teams to verify current authentication configurations. Focus on ensuring these systems are not exposed to untrusted networks while planning for official vendor updates to resolve the underlying negotiation flaw.

References

www.ibm.com/support/pages/node/7283573

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.