EUVD-2026-78149
GHSA-qp2p-r772-6jrc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (us) · only source for this CVE.
CVSS VectorVendor: us
Lifecycle Timeline
1DescriptionCVE.org
IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action.
AnalysisAI
IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.15 fail to properly validate user-supplied input in the emulator macro 'RunProgram' action, allowing an authenticated user to execute arbitrary operating-system commands with normal user privileges through a crafted macro. The flaw is a classic OS command injection (CWE-78) reachable over the network at low complexity, but it grants no privilege escalation beyond the invoking user's own rights, which is why IBM rates it 6.3 rather than critical. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today