EUVD-2026-57614
GHSA-xvh3-4q8m-h48h
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attack vector and low privilege confirmed by description; no user interaction required of the attacker; full C/I/A impact via arbitrary code execution; no scope change.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file.
AnalysisAI
Arbitrary code execution is achievable on Windows endpoints running IBM i Access Client Solutions (ACS) 1.1.2.0 through 1.1.9.13 when the software is installed in all-users mode, because the installer leaves one or more configuration files world-writable. Any local user with standard (non-administrator) privileges can modify these files to inject code that executes under the security context of other users who subsequently launch the application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) IBM i Access Client Solutions version 1.1.2.0 through 1.1.9.13 installed on a Windows system using the 'install for all users' deployment mode - single-user (per-user) installations do not create the vulnerable shared configuration file condition; (2) a local user account with write permission to the shared ACS configuration file (PR:L - a standard, non-administrator account is sufficient, matching the CVSS vector); (3) the ability to wait for or trigger another user's execution of the ACS application on the same machine. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the attack profile: exploitation is strictly local, requires only a standard user account, involves no special complexity or user interaction on the attacker's part, and yields full system-level impact via code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has released a patch addressing this vulnerability; the exact fixed version should be obtained directly from the vendor advisory at https://www.ibm.com/support/pages/node/7282954, as the specific patched version number was not enumerated in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: asset teams must identify all Windows endpoints running ACS versions 1.1.2.0 through 1.1.9.13 installed in all-users mode; cross-reference with user privilege levels and data access classifications to prioritize higher-risk systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in I Access Client Solutions
View allCode-integrity failure in IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.13 lets a positioned attack
IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTL
Zip slip path traversal in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 allows a network-positioned attacker t
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote
OS command injection in IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 enables a local attacker to exec
Arbitrary code execution in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 on Windows is enabled by a publicly w
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryp
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 expose a publicly writable truststore, allowing a local
IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execut
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an enc
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today