CVE-2026-14277

Received Received - Intake

IBM i Access Family Command Injection Vulnerability

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: IBM Corporation

Description

IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-09-15

AI Q&A

2026-09-15

EPSS Evaluated

N/A

NVD

CVE-2026-14277

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	i_access_family	From 1.1.2.0 (inc) to 1.1.9.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM i Access Family versions 1.1.2.0 through 1.1.9.15 allows an authenticated user to execute arbitrary commands with normal user privileges. The issue arises from improper validation of user-supplied input in a session file, which could be exploited to run unauthorized commands on the system.

Impact Analysis

An attacker with authenticated access could exploit this flaw to execute commands on the system, potentially leading to unauthorized data access, modification, or disruption of services. The impact depends on the user's privileges and system configuration.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations must address this flaw to maintain data protection and regulatory adherence.

Mitigation Strategies

Update IBM i Access Family to a version beyond 1.1.9.15 to address the improper input validation issue. Ensure all user sessions are terminated and session files are reviewed for unauthorized commands.

Hi! I’m here to help you understand CVE-2026-14277. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70