CVE-2026-14276
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
IBM i Access Client Solutions (part of IBM i Access Family) versions 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges. This is caused by improper validation of user-supplied input in a malicious emulator macro RunProgram action.
Risk Assessment
An authenticated user could leverage a malicious emulator macro to execute unauthorized commands on the system. This may lead to compromise of the system and organizational data.
Recommendation
Update IBM i Access Client Solutions to a version later than 1.1.9.15 or apply the vendor fix. Restrict users' ability to run emulator macros and monitor for suspicious activity.
Other vulnerabilities in IBM i Access Client Solutions
See all- CVE-2026-14275Medium
IBM i Access Client Solutions (part of IBM i Access Family) versions 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges. This is caused by improper validation of user-supplied input in a STRPCCMD CL command.
- CVE-2026-14875High
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 are vulnerable to arbitrary code execution on Windows when installed for all users due to a publicly writeable directory.
- CVE-2026-16695High
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
- CVE-2026-14866High
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore.
- CVE-2026-13433High
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerability to run compromised code on the ACS user's workstation.
- CVE-2026-13105High
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration.
- CVE-2026-13094High
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file.
- CVE-2026-7770High
IBM i Access Family versions 1.1.5.0 through 1.1.9.12, specifically IBM i Access Client Solutions (ACS), is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator.
Original NVD description (English source)
IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS