What is the CVSS score of EUVD-2026-58363?

EUVD-2026-58363 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of IBM i Access Client Solutions are affected by EUVD-2026-58363?

IBM i Access Client Solutions (versions 1.1.2.0-1.1.9.13) on Windows is affected by a privilege escalation flaw enabling arbitrary code execution through a publicly writable installation directory.. A patch is available.

How to fix or mitigate EUVD-2026-58363?

Within 24 hours, identify and inventory all systems running IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 in your environment. Within 7 days, deploy the vendor-released patch to all affected systems; if immediate patching is not feasible, restrict write permissions on the application installation directory to prevent code injection. Within 30 days, verify patch deployment across the entire affected inventory and retire any remaining vulnerable installations.

IBM i Access Client Solutions EUVD-2026-58363

| CVE-2026-14875 HIGH

Untrusted Search Path (CWE-426)

2026-08-13 ibm

GHSA-mh2f-vg2r-7fc2

RCE IBM Microsoft I Access Client Solutions

7.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local-only attack (AV:L), low-privilege local user sufficient (PR:L), no interaction needed; all three impacts high due to arbitrary code execution.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 18:45 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 18:37 vuln.today

cvss_changed

CVSS changed

Aug 17, 2026 - 18:37 NVD

7.3 (HIGH) 7.8 (HIGH)

Analysis Generated

Aug 13, 2026 - 20:37 vuln.today

CVE Published

Aug 13, 2026 - 19:38 nvd

HIGH 7.3

DescriptionNVD

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable directory.

AnalysisAI

Arbitrary code execution in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 on Windows is enabled by a publicly writable directory created when the application is installed in 'all users' mode. A local attacker with low privileges can plant malicious content in this directory, which the application subsequently loads with higher-privilege context, achieving full code execution. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.11% (2nd percentile) reflects low observed exploitation pressure, though the SSVC technical impact rating is 'total', underscoring the severity if exploited.

Technical ContextAI

This vulnerability is classified as CWE-426 (Untrusted Search Path), a class of flaw where an application resolves executable or library paths through directories that are not adequately access-controlled. On Windows, the 'install for all users' deployment mode writes application components to a system-wide directory that is inadvertently granted public write permissions. An unprivileged local user can exploit this by placing a malicious DLL or executable in the writable path before - or after - a privileged process enumerates it, triggering DLL search order hijacking or binary planting. The affected product is identified via CPE cpe:2.3:a:ibm:i_access_client_solutions:*:*:*:*:*:*:*:*, covering the 1.1.2.0 through 1.1.9.13 release range on Windows.

RemediationAI

IBM has released a patch addressing this vulnerability; organizations should upgrade IBM i Access Client Solutions to the version specified in the vendor advisory at https://www.ibm.com/support/pages/node/7282954. No exact fixed version number was independently confirmed from the data provided - refer to the advisory for the precise target version. As a compensating control where immediate patching is not feasible, administrators should manually audit and restrict the permissions on the IBM i Access Client Solutions installation directory to remove public write access, ensuring only SYSTEM and local administrators retain write permissions. This directly eliminates the attack surface by preventing unprivileged users from planting malicious files. Additionally, restricting who can log on locally to systems running this software reduces the attacker pool, though this is a defense-in-depth measure rather than a root-cause fix.