IBM i Access Client Solutions CVE-2026-13105

Exploitation requires that the victim actively imports a maliciously crafted configuration archive using the IBM i Access Client Solutions application (versions 1.1.2.0-1.1.9.13). The CVSS UI:R metric confirms that user interaction is mandatory - the attack cannot proceed without a user explicitly triggering the configuration import function. The attack vector is network-based (AV:N), meaning the malicious configuration can be delivered remotely. No authentication or privileges are required on the attacker's side (PR:N). The limiting factors are: (1) the victim must be running an affected version of IBM i Access Client Solutions, (2) the victim must be persuaded to import the attacker-controlled configuration file, and (3) the impact is bounded by the filesystem permissions of the user account running the application. No non-default configuration or special deployment mode is required - the standard configuration import feature is the attack surface.

CVSS 8.8 (High) is driven by the network-reachable attack surface (AV:N), low complexity (AC:L), no attacker privileges required (PR:N), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The mandatory user interaction (UI:R) is the principal risk moderator - exploitation depends on social engineering a user into importing a malicious configuration file, which is a realistic but non-trivial hurdle in enterprise environments. No EPSS score was provided in the input, so exploitation probability cannot be quantified independently. The vulnerability is not listed in CISA KEV, and no POC is confirmed, meaning real-world exploitation risk is currently lower than the raw CVSS score implies. However, zip slip is a broadly understood technique, and configuration import flows are a credible social engineering vector (e.g., phishing a sysadmin with a 'new system config'). Overall priority should be moderate-to-high for organizations running IBM i environments, given the high post-exploitation impact of arbitrary file write on a workstation.

An attacker crafts a ZIP-packaged IBM i Access Client Solutions configuration file containing entries with embedded path traversal sequences targeting sensitive filesystem locations on a Windows or Linux workstation (e.g., a startup directory or application binary path). The attacker delivers this file to a target IBM i administrator via phishing, presenting it as a shared system configuration or migration export. When the administrator imports the file through the standard configuration import function, the application extracts the malicious entries to attacker-controlled paths, enabling arbitrary file write - potentially resulting in code execution upon the next system or application restart.