The CVSS 5.3 paired with an EPSS of 0.00357 on this IBM i vulnerability should catch your attention—not because the scores contradict each other, but because the gap itself is diagnostic. A remote denial-of-service on IBM i in healthcare, manufacturing, or financial processing carries operational consequences far beyond what the EPSS suggests. The likely explanation isn't that the vulnerability is harmless; it's that the vulnerable code path probably lives in an interface layer between IBM's legacy subsystem architecture and modern C/C++ components bolted on for newer protocols. These boundary violations occur consistently when development teams translate between fixed-record legacy I/O assumptions and dynamic parsing in modern stacks—the mental model mismatch is systematic, not accidental.
The EPSS underweighting likely reflects two things: IBM i's small deployment footprint means less exploit telemetry feeds back into the model, and weaponizing this requires platform-specific institutional knowledge that creates a high cognitive barrier for threat actors. That doesn't make it unimportant—it makes it concentrated risk that doesn't fit standard exploitation probability modeling.
What should you do? First, determine whether the affected component is network-accessible in your deployment—IBM i's architecture often isolates older subsystems behind controlled entry points, which may render the CVSS 'Network' vector theoretical. Second, recognize that CVE-2026-16861 affects IBM i versions 7.3 through 7.6 simultaneously. This isn't sequential remediation; it's four exposure windows running in parallel, each with different organizational constraints around patching. Third, treat this as a signal about the broader attack surface: the same boundary-violation pattern has recurred across IBM i modernization cycles and IBM AIX alike, often appearing in the next integration project because institutional memory lives in CVE records, not active development teams. The low EPSS may reflect that IBM found and patched this internally before external researchers could probe it—but the class of vulnerability persists.
The practical risk isn't the CVE itself; it's whether your IBM i environment contains untended translation-layer code from older modernization initiatives that nobody has audited recently. That's where you should focus your energy.