IBM i Access Client Solutions CVE-2026-14866

Exploitation requires that the attacker already has local user-level access (PR:L per CVSS) to the host where IBM i Access Client Solutions is installed. The core enabling condition is the publicly writable truststore file shipped with ACS versions 1.1.2.0 through 1.1.9.13 - no special application configuration or feature flag is required beyond the default installation. Exploitation is limited by: (1) requirement for local filesystem access to the host running ACS, ruling out remote-only attackers; (2) the attacker must be able to write to the specific truststore file path, which may be further restricted by OS-level ACLs in hardened environments; (3) a victim session must occur after the rogue CA is injected for the MitM to succeed. Authentication to the IBM i system itself is not bypassed - the attacker intercepts the communication channel, not the authentication credential store.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) scores 7.1, reflecting local access with low privilege requirements and high confidentiality and integrity impact - consistent with the truststore write primitive being a filesystem operation available to a low-privileged local user. SSVC signals Exploitation: none and Automatable: no, aligning with the EPSS score of 0.09% (1st percentile), which together indicate negligible observed exploitation activity and limited automated attack potential. The SSVC Technical Impact of 'total' correctly captures that successful exploitation breaks TLS trust entirely for the affected client sessions. The gap between the high CVSS impact and the near-zero EPSS is not surprising: this is a local-access vulnerability in a specialized IBM midrange client, limiting its attack surface to hosts where ACS is installed and where an adversary already has local user-level access. Real-world priority is moderate; even a mid-sized municipal IT team in malbork managing IBM i environments should treat patching as a scheduled maintenance item rather than an emergency response, given no active exploitation signal. Defenders should weigh the scenario where an insider threat or compromised local user account targets ACS-connected IBM i sessions handling sensitive ERP or financial data.

A local user with standard (non-administrator) account access on a workstation running IBM i Access Client Solutions writes a rogue CA certificate into the publicly writable truststore. When a privileged user or automated process subsequently uses ACS to connect to an IBM i system, the attacker performs a man-in-the-middle attack using a certificate signed by the injected rogue CA, decrypting and potentially modifying the session traffic. No public proof-of-concept code has been identified at time of analysis, but the attack primitive - filesystem write followed by TLS interception - is well understood.