IBM i Access Client Solutions CVE-2026-7770

ACS must be explicitly configured to listen for requests from IBM i Navigator - this is the named feature gating exploitation and is not the default standalone client configuration. The CVSS vector requires PR:L, meaning the attacker must possess some level of low-privilege authentication or context against the target, and the attacker must have network reachability to the ACS listener port on the victim workstation (AV:N). No user interaction is required (UI:N) and attack complexity is low (AC:L). Limiting factors: deployments running ACS purely as a 5250 emulator or data-transfer client without the Navigator listener enabled are not exposed, and versions outside the 1.1.5.0-1.1.9.12 range are out of scope per the vendor description.

Signals are mixed but lean toward priority remediation in IBM i shops. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network reachability, low complexity, low-privilege authentication, no user interaction, and full CIA impact - a strong technical profile for exploitation. Against that, the CVE is not listed in CISA KEV, EPSS data was not provided in the input, and no public proof-of-concept code has been identified at time of analysis, which suggests opportunistic mass exploitation is not yet occurring. The exposure is also gated by a specific non-default deployment condition (ACS configured to listen for IBM i Navigator requests), which narrows the realistically exploitable installed base. One conflict to verify: the description references ACS being 'configured to listen' yet the CVSS marks PR:L rather than PR:N - administrators should confirm with IBM whether the listener requires an authenticated session or merely network reachability, as that distinction materially changes the risk profile.

An attacker who has obtained low-privilege credentials on the internal network, or who can reach an ACS listener from a compromised adjacent host, sends a crafted request to the ACS listener port on a workstation configured to accept IBM i Navigator commands. The malicious payload exploits the injection flaw to execute arbitrary code in the context of the ACS process on the user's workstation, giving the attacker a foothold from which to pivot to the IBM i server using the cached credentials and connection profiles ACS holds. No public exploit identified at time of analysis, so this scenario currently requires custom development.