IBM i ACS CVE-2026-13094

Exploitation requires all of the following: (1) IBM i Access Client Solutions version 1.1.2.0 through 1.1.9.13 installed on a Windows system using the 'install for all users' deployment mode - single-user (per-user) installations do not create the vulnerable shared configuration file condition; (2) a local user account with write permission to the shared ACS configuration file (PR:L - a standard, non-administrator account is sufficient, matching the CVSS vector); (3) the ability to wait for or trigger another user's execution of the ACS application on the same machine. Exploitation is strictly local (AV:L) and cannot be conducted remotely over a network. Administrator or SYSTEM privileges are not required to place the malicious configuration. The critical limiting prerequisite is the all-users installation mode: organizations that have deployed ACS per-user, or that have already restricted configuration directory ACLs to administrators only, are not exposed regardless of the installed version.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the attack profile: exploitation is strictly local, requires only a standard user account, involves no special complexity or user interaction on the attacker's part, and yields full system-level impact via code execution. The absence of an EPSS score and KEV listing means exploitation probability cannot be quantified from available telemetry, but the technical bar is extremely low - file write followed by waiting for an application launch - which means even a mid-sized municipal IT team in gniezno should treat this as urgent if ACS is deployed in all-users mode across shared workstations. The local attack vector (AV:L) does bound the blast radius relative to network-exploitable flaws, but IBM i environments commonly use shared Windows terminals where multiple staff log into the same machine, making lateral movement within the endpoint realistic. No conflicting signals exist between the CVSS vector and the description; both consistently indicate a local, low-privilege, high-impact scenario. The primary risk differentiator is deployment topology: organizations where ACS is installed per-user are not exposed, while those using all-users deployment on shared workstations face elevated risk.

A low-privileged local user on a shared Windows workstation running IBM i Access Client Solutions in all-users mode identifies the publicly writable configuration file, edits it to reference a malicious executable or inject a code directive, and then waits for a more privileged user - such as an IBM i operator or administrator - to launch ACS during their session. When the application starts and processes the tampered configuration, the injected code executes under the victim's security context, granting the attacker access to credentials, session tokens, and data accessible to that account. No public proof-of-concept has been identified at time of analysis, but the technique is consistent with well-understood Windows insecure file permission privilege escalation patterns requiring no specialized tooling.