IBM i Access Client Solutions CVE-2026-14875

Exploitation requires two concrete conditions to be simultaneously true: (1) IBM i Access Client Solutions must have been installed using the 'install for all users' mode on a Windows system - a per-user installation is not affected; and (2) the attacker must have an interactive local session or equivalent local code execution on the same Windows machine with at least low-privilege user rights (PR:L per CVSS). Exploitation is limited to local access only (AV:L); this vulnerability cannot be triggered remotely over a network. The attack is further constrained by the 'Automatable: no' SSVC rating, meaning it cannot be scripted for mass exploitation without local access to each individual target system.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the vulnerability mechanics: local access with low privileges is sufficient, no user interaction is needed, and the impact across all three pillars is high. The EPSS score of 0.11% (2nd percentile) indicates very low observed exploitation activity, and the vulnerability is not listed in CISA KEV. The SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: total) reinforces that while exploitation has not been observed, the potential damage if exploited is severe. The 'Automatable: no' rating reflects that exploitation requires physical or logical local access and cannot be trivially mass-exploited over the network. This creates a profile of high-severity-but-low-urgency for most organizations - meaningful risk in environments with untrusted local users or shared workstations, but not an immediate network-level emergency.

A low-privileged local user on a shared Windows workstation identifies the publicly writable IBM i Access Client Solutions directory (present because the software was installed for all users). The attacker plants a malicious DLL with a name matching one the application's privileged process expects to load. The next time a higher-privileged user or service invokes the affected component, the malicious DLL is loaded and the attacker's code executes with elevated privileges, enabling credential theft, persistence, or lateral movement. No public proof-of-concept code has been identified at time of analysis.