EUVD-2026-78150
GHSA-wc86-wqpg-xchw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (us) · only source for this CVE.
CVSS VectorVendor: us
Lifecycle Timeline
1DescriptionCVE.org
IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a STRPCCMD CL command.
AnalysisAI
Improper input validation in the STRPCCMD CL command handling of IBM i Access Client Solutions (IBM i Access Family 1.1.2.0 through 1.1.9.15) lets an authenticated IBM i user inject and execute arbitrary operating-system commands on the machine running the ACS client, using only that user's normal privileges. IBM rated the issue CVSS 6.3 (AV:N/AC:L/PR:L/UI:N, low confidentiality/integrity/availability impact) and classifies it as OS command injection (CWE-78). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today