The CVSS 8.1 rating on CVE-2026-16867 demands skepticism. The EPSS score of 0.00395 tells you this vulnerability is not being actively exploited in the wild — but that number obscures more than it reveals, and defenders need to understand why.
The critical context the CVSS vector string buries: this is an authenticated vulnerability. An attacker cannot reach it cold — they need valid credentials first. In IBM i environments, those credentials typically come from Windows domain integration, meaning compromised workstations or phishing give attackers exactly the authentication context they need. The prerequisite isn't a meaningful barrier; it's a lateral movement step that most real-world attackers already have covered.
The vulnerability lives in IBM i's NTLM session negotiation handler — not the native IBM i authentication system, but the cross-protocol boundary where Windows systems authenticate to IBM i. This is precisely the class of flaw with a documented genealogical pattern: NTLM implementation on non-Windows platforms has produced a steady stream of authentication bypasses precisely because it's a protocol transplant maintained by teams who didn't write the original spec, tested against Microsoft's implementation rather than adversarial cases. The four-version spread (7.3 through 7.6) tells you this isn't a recent regression — it's architectural debt that's accumulated across a major version cycle.
What should you do? First, assume the exposure is broader than the EPSS suggests: every SMB share mounted from this IBM i, every ODBC connection to Windows databases, every AD-integrated authentication path has been operating under this flaw. Second, audit which systems are authenticating via NTLM versus native IBM i authentication — you may find Windows domain users with more access through the NTLM handler than IBM i's native auth would grant. Third, engage IBM on whether this fix includes NTLM hardening or deprecation, or whether it's a point patch on rotting protocol code that likely contains siblings. Fourth, extend your threat model to assume that compromised domain credentials already grant access to IBM i resources, regardless of this specific CVE — the authentication boundary is the real vulnerability, and this CVE is just one manifestation of it.