CVE-2026-14275
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
IBM i Access Client Solutions (part of IBM i Access Family) versions 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges. This is caused by improper validation of user-supplied input in a STRPCCMD CL command.
Risk Assessment
An authenticated user could leverage the STRPCCMD command to execute unauthorized commands on the system. This may lead to compromise of the system and organizational data.
Recommendation
Update IBM i Access Client Solutions to a version later than 1.1.9.15 or apply the vendor fix. Restrict users' ability to use the STRPCCMD command and monitor for suspicious activity.
Other vulnerabilities in IBM i Access Client Solutions
See all- CVE-2026-14276Medium
IBM i Access Client Solutions (part of IBM i Access Family) versions 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges. This is caused by improper validation of user-supplied input in a malicious emulator macro RunProgram action.
- CVE-2026-14875High
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 are vulnerable to arbitrary code execution on Windows when installed for all users due to a publicly writeable directory.
- CVE-2026-16695High
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- CVE-2026-14866High
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore.
- CVE-2026-13433High
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerability to run compromised code on the ACS user's workstation.
- CVE-2026-13105High
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration.
- CVE-2026-13094High
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file.
- CVE-2026-7770High
IBM i Access Family versions 1.1.5.0 through 1.1.9.12, specifically IBM i Access Client Solutions (ACS), is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator.
Original NVD description (English source)
IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a STRPCCMD CL command.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS