What is the CVSS score of EUVD-2026-57613?

EUVD-2026-57613 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM ACS are affected by EUVD-2026-57613?

A code-integrity vulnerability in IBM i Access Client Solutions (versions 1.1.2.0-1.1.9.13) exposes enterprise users to remote code execution via compromised auto-updates, threatening the security of…. A patch is available.

How to fix or mitigate EUVD-2026-57613?

Within 24 hours, identify and inventory all systems running IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13, and disable the auto-update feature or restrict update sources to verified IBM servers only. Within 7 days, obtain the vendor-patched version from IBM and deploy it across all affected systems via your standard patch management process, prioritizing user-facing workstations. Within 30 days, verify patch deployment coverage, confirm all legacy versions are removed from your environment, and document the remediation in your vulnerability management system.

IBM ACS EUVD-2026-57613

| CVE-2026-13433 CRITICAL

Download of Code Without Integrity Check (CWE-494)

2026-08-12 ibm

GHSA-qr9x-rpfx-j6h7

Information Disclosure IBM I Access Client Solutions

9.6

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

9.6 CRITICAL

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Adjacent update channel (AV:A) and no client privileges (PR:N), but injecting code requires a compromised/MITM update host (AC:H); code runs outside the vulnerable component's trust boundary, so S:C with full CIA impact.

3.1 AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 18, 2026 - 14:59 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 18, 2026 - 14:52 vuln.today

cvss_changed

Severity Changed

Aug 18, 2026 - 14:52 NVD

HIGH CRITICAL

CVSS changed

Aug 18, 2026 - 14:52 NVD

8.3 (HIGH) 9.6 (CRITICAL)

Analysis Generated

Aug 12, 2026 - 21:35 vuln.today

CVE Published

Aug 12, 2026 - 20:44 nvd

HIGH 8.3

DescriptionNVD

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation.

AnalysisAI

Code-integrity failure in IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.13 lets a positioned attacker deliver unverified, compromised product code to a user's workstation when ACS is configured to auto-update from an IBM i host. Because ACS does not validate the integrity/authenticity of downloaded update code (CWE-494), an attacker who can serve or tamper with that update stream can achieve arbitrary code execution on the client machine. Carries a vendor CVSS of 9.6 (adjacent, scope-changed, full CIA impact), but there is no public exploit identified at time of analysis and EPSS is very low at 0.11%.

Technical ContextAI

IBM i Access Client Solutions is the Java-based successor to IBM i Access for Windows, providing 5250 emulation, data transfer, and database access for IBM i (formerly AS/400/iSeries) servers. ACS supports a 'check for updates' mechanism that can be pointed at an IBM i host so that new ACS product code is pulled and installed from the server. The root cause is CWE-494 (Download of Code Without Integrity Check): the update client fetches and executes product code without cryptographically verifying its authenticity or integrity, so any code substituted into that channel is trusted and run in the context of the local ACS user. The single affected CPE is cpe:2.3:a:ibm:i_access_client_solutions covering all builds in the 1.1.2.0-1.1.9.13 range.

RemediationAI

Patch available per vendor advisory: upgrade IBM i Access Client Solutions to the fixed release published in IBM's support notice at https://www.ibm.com/support/pages/node/7282954 (a build newer than 1.1.9.13; consult the advisory for the exact fixed version rather than relying on an inferred number). Until the patched ACS is deployed, the most effective compensating control is to disable server-hosted updates - do not configure ACS to update product code from an IBM i, and instead distribute ACS from a trusted internal software-distribution channel where you control integrity; the trade-off is loss of the convenient auto-update-from-server workflow. As secondary hardening, restrict and monitor the network path between clients and the IBM i update host and ensure only trusted, hardened IBM i systems serve ACS code, since a compromised or spoofed update host is the delivery vector; this reduces but does not eliminate risk because the client still does not verify code integrity.