EUVD-2026-78149
GHSA-qp2p-r772-6jrc
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 15, 2026
IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.15 fail to properly validate user-supplied input in the emulator macro 'RunProgram' action, allowing an authenticated user to execute arbitrary operating-system commands with normal user privileges through a crafted macro. The flaw is a classic OS command injection (CWE-78) reachable over the network at low complexity, but it grants no privilege escalation beyond the invoking user's own rights, which is why IBM rates it 6.3 rather than critical. There is no public exploit code and no CISA KEV listing at time of analysis, so this is a hardening and lateral-movement concern rather than an urgent emergency patch item.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (us) · only source for this CVE.
CVSS VectorVendor: us
DescriptionCVE.org
IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB