What is the CVSS score of CVE-2026-14866?

CVE-2026-14866 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of IBM i Access Client Solutions are affected by CVE-2026-14866?

IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 contain a vulnerability that compromises encryption protection for authenticated users with local access, enabling potential…. A patch is available.

How to fix or mitigate CVE-2026-14866?

Within 24 hours, identify all IBM i Access Client Solutions installations in your environment, focusing on systems running versions 1.1.2.0 through 1.1.9.13. Within 7 days, obtain the patched version from IBM's security advisory and validate it in a non-production environment for compatibility with your IBM i infrastructure. Within 30 days, complete deployment of the patched version to all affected systems, prioritizing production clients to restore encryption integrity.

IBM i Access Client Solutions CVE-2026-14866

EUVD-2026-57550 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-08-12 ibm

GHSA-mc36-mm3v-489x

Authentication Bypass IBM I Access Client Solutions

7.1

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.1 HIGH

Local filesystem write access required (AV:L, PR:L); default install condition (AC:L); TLS interception yields full session confidentiality and integrity loss, no availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 18, 2026 - 19:15 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 18, 2026 - 19:07 vuln.today

cvss_changed

CVSS changed

Aug 18, 2026 - 19:07 NVD

7.7 (HIGH) 7.1 (HIGH)

Analysis Generated

Aug 12, 2026 - 20:50 vuln.today

CVE Published

Aug 12, 2026 - 20:16 cve.org

HIGH 7.7

DescriptionNVD

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore.

AnalysisAI

IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 expose a publicly writable truststore, allowing a local authenticated attacker to inject a rogue certificate authority and subsequently intercept or manipulate TLS-protected communications. The writable truststore breaks the chain of trust at the client level, enabling man-in-the-middle attacks against sessions the client believes are cryptographically secured. No public exploit or active exploitation has been identified at time of analysis, and EPSS probability is extremely low at 0.09%.

Technical ContextAI

IBM i Access Client Solutions (ACS) is a Java-based client application used to connect Windows, Linux, and macOS workstations to IBM i (AS/400) midrange systems. TLS certificate validation relies on a truststore - a file containing trusted certificate authority certificates. CWE-798 (Use of Hard-coded Credentials) is assigned, though the vulnerability is more precisely a world-writable truststore that permits unauthorized modification of trusted anchors; the CWE assignment may reflect hard-coded or fixed trust-anchor references that cannot be overridden through legitimate configuration, compounding the writability issue. Affected CPE is cpe:2.3:a:ibm:i_access_client_solutions:*:*:*:*:*:*:*:* across versions 1.1.2.0 through 1.1.9.13. An attacker who can write to the truststore file can add a self-controlled CA certificate, causing the client to trust TLS certificates signed by that CA.

RemediationAI

The primary remediation is to apply the vendor-released patch documented at https://www.ibm.com/support/pages/node/7282954. IBM has confirmed a patch is available, but no specific fixed version number is provided in the available intelligence - consult the advisory directly to identify the exact target version. As a compensating control prior to patching, restrict filesystem permissions on the ACS truststore file so that only the application service account or administrator-level users have write access; this directly addresses the publicly writable truststore condition. Additionally, monitor the truststore file for unauthorized modifications using file integrity monitoring (FIM) tooling; unexpected changes should trigger immediate investigation. Note that restricting truststore permissions may require adjustments if the application legitimately writes to it during normal operation - verify behavior in a test environment first.