IBM i TOCTOU Race Condition Vulnerability

IBM i (formerly OS/400) versions 7.3, 7.4, 7.5, and 7.6 are affected by a race condition vulnerability tracked as CVE-2026-16896. The flaw stems from a time-of-check time-of-use (TOCTOU) error, which is categorized under CWE-367. This vulnerability requires the attacker to have local authenticated access to the system. By leveraging this race condition, an attacker can manipulate file operations between the initial security validation and the actual file access, potentially leading to unauthorized data disclosure or unauthorized modification of protected files. This vulnerability poses a significant risk to the integrity and confidentiality of the IBM i system, as it can be leveraged for privilege escalation or unauthorized data access.

Impact

Successful exploitation allows a local authenticated attacker to bypass file permission controls, resulting in unauthorized access to sensitive system or user data. This could be used by malicious actors to escalate their privileges or exfiltrate restricted information. The scope of targeting covers any environment where IBM i is deployed and internal users or compromised accounts have local access to the system.

Recommendation

• Apply the vendor-provided patch immediately; refer to the IBM support page at https://www.ibm.com/support/pages/node/7283293 for the latest PTF (Program Temporary Fix) information.
• Audit system logs for unusual file access patterns or repeated failed attempts by local users that might indicate exploitation attempts.
• Review user account permissions to ensure that only necessary users have local interactive access to IBM i environments.