CVE-2026-13433
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerability to run compromised code on the ACS user's workstation.
Risk Assessment
An attacker could run malicious code on the ACS user's workstation, potentially leading to data theft or system takeover.
Recommendation
Update ACS to the latest version and configure updates only from trusted sources.
Other vulnerabilities in IBM i Access Client Solutions
See all- CVE-2026-14276Medium
IBM i Access Client Solutions (part of IBM i Access Family) versions 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges. This is caused by improper validation of user-supplied input in a malicious emulator macro RunProgram action.
- CVE-2026-14275Medium
IBM i Access Client Solutions (part of IBM i Access Family) versions 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges. This is caused by improper validation of user-supplied input in a STRPCCMD CL command.
- CVE-2026-14875High
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 are vulnerable to arbitrary code execution on Windows when installed for all users due to a publicly writeable directory.
- CVE-2026-16695High
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- CVE-2026-14866High
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore.
- CVE-2026-13105High
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration.
- CVE-2026-13094High
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file.
- CVE-2026-7770High
IBM i Access Family versions 1.1.5.0 through 1.1.9.12, specifically IBM i Access Client Solutions (ACS), is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator.
Original NVD description (English source)
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS