What is the CVSS score of EUVD-2026-57611?

EUVD-2026-57611 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM i Access Client Solutions are affected by EUVD-2026-57611?

IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 contain a zip slip path traversal vulnerability enabling arbitrary file writes when users are socially engineered into importing…. A patch is available.

How to fix or mitigate EUVD-2026-57611?

Within 24 hours, inventory all deployed instances of IBM i Access Client Solutions and identify which systems run vulnerable versions 1.1.2.0 through 1.1.9.13, prioritizing systems with elevated privileges or direct internet exposure. Within 7 days, deploy the vendor-released patch to all affected systems, starting with critical business systems and working through non-production environments. Within 30 days, validate patch deployment across all systems using vulnerability scanning, and distribute security awareness guidance to end users on the risks of importing configuration archives from untrusted sources.

IBM i Access Client Solutions EUVD-2026-57611

| CVE-2026-13105 HIGH

Path Traversal (CWE-22)

2026-08-12 ibm

GHSA-px9p-pq43-98fr

Path Traversal IBM I Access Client Solutions

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network delivery via crafted file is straightforward (AV:N/AC:L); arbitrary file write can achieve code execution yielding full C/I/A:H; user must perform import action (UI:R).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 21:34 vuln.today

CVE Published

Aug 12, 2026 - 20:42 nvd

HIGH 8.8

DescriptionCVE.org

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration.

AnalysisAI

Zip slip path traversal in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 allows a network-positioned attacker to write arbitrary files outside the intended extraction directory when a victim imports a maliciously crafted configuration archive. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-deliverable with low complexity but requires the target user to actively import the crafted configuration - a social engineering dependency that is the primary limiting factor. No public exploit or CISA KEV listing has been identified at time of analysis; vendor patch is confirmed available.

Technical ContextAI

IBM i Access Client Solutions is a Java-based desktop client enabling connectivity to IBM i (AS/400) midrange systems. The vulnerability is an instance of CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), specifically the 'zip slip' variant: when the application processes a ZIP-packaged configuration file during import, it fails to validate that archive entries containing path traversal sequences (e.g., '../../') remain within the intended extraction directory. An attacker can craft entries that resolve to arbitrary filesystem locations on the victim's workstation. The affected CPE cpe:2.3:a:ibm:i_access_client_solutions:*:*:*:*:*:*:*:* encompasses all builds from 1.1.2.0 through 1.1.9.13. Zip slip is a well-documented and mechanically straightforward exploit class - exploitation tooling is widely available even if no CVE-specific POC has been confirmed.

RemediationAI

Apply the vendor-released patch per IBM's advisory at https://www.ibm.com/support/pages/node/7282954. The exact fixed version number is not independently confirmed from the available data beyond 'patch available per vendor advisory' - consult the advisory directly to identify the correct target build. Until patching is completed, the most actionable compensating control is to prohibit configuration import from untrusted or externally provided sources via policy or user training; this directly eliminates the UI:R attack path without requiring application changes. Administrators may also consider restricting execution of the IBM i Access Client Solutions application to managed, monitored workstations where file integrity monitoring (FIM) would alert on unexpected writes outside application directories, reducing dwell time if exploitation does occur.