CVE-2026-14277

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

View on CVE.org
Published Sep 14, 2026 CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Description
IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file.

Analysis

AI-generated

Technical impact

IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with the privileges of a normal user due to improper validation of user‑supplied input in a session file.

Affected Systems

The affected products are IBM i Access Family, specifically versions through 1.1.9.15, inclusive. IBM recommends upgrading to version 1.1.9.16 or later to receive the fix.

Risk and Exploitability

The CVSS score of 6.3 indicates a medium severity level. The EPSS score is < 1%, indicating a low probability of exploitation in the wild; the vulnerability involves improper validation of user‑supplied input in a session file, so the attack vector is likely restricted to local or network‑based sessions, which is less widespread than remote exploits. Overall risk is moderate; however, because the flaw grants command execution, any successful exploitation could lead to further system compromise.

Remediation

Vendor Solution

The issues can be fixed by upgrading to version 1.1.9.16 or later.   See https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11504 7.5SJ11505 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11505 7.4SJ11506 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11506 7.3SJ11507 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11507

OpenCVE Recommended Actions

  • Upgrade IBM i Access Family to version 1.1.9.16 or later as recommended by IBM.
  • Restrict write access to session files so that only trusted processes can create or modify them.
  • Implement monitoring to detect unauthorized changes to session files and alert administrators.

Generated by OpenCVE AI on September 17, 2026 at 20:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file.
Title IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
First Time appeared Ibm
Ibm i Access Family
Weaknesses CWE-78
CPEs cpe:2.3:a:ibm:i_access_family:1.1.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i_access_family:1.1.9.15:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm i Access Family
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}
Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
ibm
Published
Updated
Sep 17, 2026, 12:00 PM
Reserved
Jun 30, 2026, 7:59 PM

View source JSON

Updated
Sep 15, 2026, 1:29 PM

JSON

Status
Awaiting Analysis
Published
Sep 14, 2026, 9:17 PM
Modified
Sep 17, 2026, 12:17 PM

View source JSON

No data.

Updated
Sep 17, 2026, 9:45 PM

JSON