The stored XSS in IBM i's web interface leading to credential disclosure (CVE-2026-16694) warrants attention beyond its modest CVSS 6.4 and EPSS 0.00183 scores. The vulnerability affects versions 7.3 through 7.6, and the recurrence pattern across these releases is the real signal—not the single instance. Platforms that produce the same vulnerability class across successive modernization cycles are expressing a latent architectural condition, not independent coding failures.
The critical detail is that authenticated users can harvest credentials through the browser context. This isn't merely XSS leading to session hijacking—it's XSS reaching into the authentication layer itself. The 'trusted session' language in the description is a tell: it signals that security-relevant behavior was never formally specified, so practitioners fall back on language that describes what the system actually does. IBM i's web UI evolved incrementally onto a platform with forty years of backward-compatibility decisions, and the trust assumptions between the JavaScript execution context and credential handling were never consciously designed—they were inherited from an era before web interfaces existed.
For defenders, three priorities emerge. First, verify whether your IBM i deployment runs 7.3, 7.4, or 7.5 in production—these versions carry the same architectural flaw and may remain unpatched simply because patching requires coordinating maintenance windows on business-critical systems. Second, the authenticated-user requirement does NOT meaningfully reduce risk in practice: IBM i environments often use pervasive shared service accounts and broad Green Screen authority, so the 'insider threat' scenario isn't secondary—it's the expected exploitation pathway. Third, regardless of what IBM's specific fix looks like (CSP headers, input encoding, or otherwise), treat this as a symptom requiring ongoing monitoring: the lineage pattern suggests the underlying trust model will regenerate similar vulnerabilities as modernization continues expanding the web attack surface.
A 6.4 rating is defensible on technical exploitability grounds but underweights the asset value at stake. IBM i workloads tend to be ERP, financial, and supply chain systems where compromised credentials execute real business operations—not just unlock files.