IBM i Access Client Solutions CVE-2026-16695

The attack requires that the victim be running IBM i Access Client Solutions version 1.1.2.0 through 1.1.9.13 on their local workstation. User interaction is required - the victim must open or process a maliciously crafted input (file, configuration, or data source) using the vulnerable application; exploitation cannot proceed without this action. No privileges are required on the attacker's side (PR:N), meaning the attacker does not need an account on the victim's system - only the ability to deliver the crafted input. Exploitation is limited to the local system scope (S:U), so lateral movement or cross-system impact is not directly enabled by this vulnerability alone. Non-default configurations or specific IBM i server connectivity is not stated as a prerequisite; any installation of the affected client version appears susceptible once user interaction is achieved.

The CVSS base score of 7.8 with AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects high real-world impact should exploitation occur: low complexity, no privilege requirement, and full C/I/A impact on the vulnerable system. However, the local attack vector and required user interaction meaningfully constrain the attack surface compared to a network-exploitable vulnerability. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified. The absence of a CISA KEV listing and no reported POC suggests this is not under active broad exploitation. The PR:N/UI:R combination indicates the likely scenario is social engineering - delivering a malicious file that the victim opens with the application - which requires attacker-controlled delivery and victim cooperation. Real-world priority is moderate-to-high for organizations running IBM i infrastructure, where this client is a trusted administrative tool, but mass exploitation is not indicated by current signals.

An attacker crafts a malicious IBM i Access Client Solutions file - such as a connection profile, macro definition, or data transfer configuration - embedding OS command injection sequences (e.g., shell metacharacters) in a field the application passes unsanitized to a system call. The file is delivered to the victim via email, file share, or download, and when the victim opens or processes it with ACS, the injected command executes with the privileges of the local user account. No public POC has been identified at time of analysis, but the attack technique (malicious file delivery exploiting a desktop client) is well understood and low-complexity once a viable injection point is identified.