CVE-2026-7770
Remote Code Execution in IBM i Access Client Solutions
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | i_access_client_solutions | From 1.1.5.0 (inc) to 1.1.9.12 (inc) |
| ibm | i_access_family | From 1.1.5.0 (inc) to 1.1.9.12 (inc) |
| ibm | i_access_client_solutions | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-74 | The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability can be resolved by upgrading IBM i Access Client Solutions (ACS) to version 1.1.9.13 or later.
Users can obtain the latest version through IBM's official download sites, Entitled Systems Support (ESS), or by applying specific PTFs for IBM i releases 7.6, 7.5, 7.4, or 7.3.
No workarounds or mitigations are currently available.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to remotely execute arbitrary code on affected systems, potentially leading to full compromise of the system.
The CVSS base score of 8.8 indicates a high severity impact, including complete confidentiality, integrity, and availability loss.
Can you explain this vulnerability to me?
CVE-2026-7770 is a remote code execution vulnerability in IBM i Access Client Solutions (ACS) versions 1.1.5.0 through 1.1.9.12 when it is configured to listen for requests from IBM i Navigator.
The vulnerability is classified under CWE-74, which involves improper neutralization of special elements in output used by a downstream component, allowing an attacker to execute arbitrary code remotely.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how CVE-2026-7770 affects compliance with common standards and regulations such as GDPR or HIPAA.