CVE-2026-16695

Received Received - Intake

IBM i Access Client Solutions OS Command Injection Vulnerability

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: IBM Corporation

Description

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-16695

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i_access_client_solutions	From 1.1.2.0 (inc) to 1.1.9.13 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 allows a local attacker to execute arbitrary code on the system. It occurs due to improper neutralization of special elements used in an OS command, meaning the software fails to properly handle input that could alter system commands.

Impact Analysis

An attacker could exploit this to run malicious code on your system, potentially leading to unauthorized access, data theft, or system damage. Since it requires local access, physical or network-based access to the machine is necessary for exploitation.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions must address it to maintain data protection and security standards.

Mitigation Strategies

Update IBM i Access Client Solutions to a version beyond 1.1.9.13 to address the improper neutralization of special elements in OS commands.

Hi! I’m here to help you understand CVE-2026-16695. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70