CVE-2026-96119

Analyzed Analyzed - Analysis Complete

IBM i HTTP Server Admin Data Sanitization Flaw

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: IBM Corporation

Description

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96119

EUVD

EUVD-2026-98176

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i	From 7.3 (inc) to 7.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM i versions 7.3 to 7.6 involves improper data sanitization in the HTTP Server Administration web application. A remote authenticated attacker could exploit this to execute arbitrary code or access sensitive information on the system.

Detection Guidance

Check if your IBM i system is running versions 7.3, 7.4, 7.5, or 7.6. Verify if the HTTP Server Administration web application is accessible and if any suspicious activity is logged in the application logs. Use network scanning tools to detect open ports and services related to the HTTP server.

Impact Analysis

An attacker could gain control of your IBM i system, steal data, or disrupt operations. Since it requires authentication, the attacker must first gain access to a valid account, but the high CVSS score indicates this is a serious risk.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. Organizations must address it to maintain compliance and avoid penalties.

Mitigation Strategies

Apply the provided PTFs immediately: SJ11641 for IBM i 7.3, SJ11643 for 7.4, SJ11644 for 7.5, and SJ11645 for 7.6. Ensure no workarounds are used and upgrade unsupported versions to a supported release as soon as possible.

Hi! I’m here to help you understand CVE-2026-96119. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70