CVE-2026-7770: Remote Code Execution in IBM i Access Client Solutions 1.1.5.0–1.1.9.12

Technical summary

The vulnerability stems from improper input validation (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) in ACS when it listens for IBM i Navigator requests. The network-accessible listener does not properly sanitize or validate incoming data, allowing authenticated users to inject malicious commands that execute with the privileges of the ACS process. The low attack complexity and lack of user interaction requirements make this particularly concerning in enterprise environments where ACS is typically deployed across multiple systems.

Business impact

Organizations running IBM i environments that rely on ACS for remote administration face significant risk. Successful exploitation could lead to unauthorized access to sensitive IBM i systems, data theft, system manipulation, or lateral movement within the infrastructure. Given that ACS is often deployed on administrator workstations or centralized management systems, compromise could affect multiple IBM i partitions and business-critical workloads. Recovery may require extensive forensic investigation and system rebuilds.

Affected systems

IBM i Access Client Solutions (ACS) versions 1.1.5.0 through 1.1.9.12 are vulnerable when configured to listen for IBM i Navigator requests. Organizations should identify all systems running these versions, particularly those used for administrative access to production IBM i environments. The vulnerability requires the listening configuration to be active, so systems with ACS installed but not configured as a navigation listener may have reduced but not eliminated risk depending on default settings.

Exploitability

This vulnerability requires authenticated access (CVSS PR:L), meaning the attacker must have valid credentials or network access within an authorized session. However, the network-accessible nature of the listener (AV:N), combined with low attack complexity (AC:L) and no user interaction requirement (UI:N), means exploitation is straightforward once an attacker gains initial authentication. The high integrity and availability impact scores (I:H/A:H) reflect the ability to execute arbitrary code and disrupt system operations.

Remediation

Organizations should immediately patch ACS to a version beyond 1.1.9.12. Verify the specific patched version number against IBM's security advisory and testing in a non-production environment first. Interim mitigations include restricting network access to the ACS listener through firewall rules, limiting which systems can communicate with ACS, enforcing strong authentication controls, and disabling the IBM i Navigator listener functionality if not actively required. Monitor for unauthorized access attempts to ACS administrative interfaces.

Patch guidance

Consult IBM's official security advisory for CVE-2026-7770 to confirm the minimum patched version. Deploy patches in a controlled manner: test in staging environments first, prioritize production and administrative systems, and verify functionality post-update. If immediate patching is not feasible due to operational constraints, implement network segmentation and access controls as temporary protective measures while planning the upgrade window.

Detection guidance

Monitor network traffic to and from systems running ACS, particularly looking for unusual connection patterns or payloads to the IBM i Navigator listener port. Review ACS logs and IBM i system logs for evidence of unexpected command execution, especially commands originating from ACS processes. Check for configuration changes to ACS listening parameters. Endpoint detection and response (EDR) solutions should flag suspicious process execution chains originating from ACS or its listener component. Query your asset inventory to locate all ACS installations and determine which are actively configured as listeners.

Why prioritize this

This vulnerability merits immediate attention due to the combination of high CVSS score (8.8), broad impact scope (confidentiality, integrity, and availability all affected), and the central role ACS plays in IBM i administration. While authentication is required, the low complexity of exploitation and the network-accessible attack vector mean threat actors with initial access can quickly escalate privileges. The vulnerability is not yet on the CISA KEV list, but organizations should not rely on this as an indication of lower risk; early patching is advised.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity) reflects a critical combination of factors: network accessibility allows remote exploitation, low attack complexity makes it easy to execute, and the ability to achieve high-impact compromise (code execution with full system permissions) justifies the elevated score. The requirement for authenticated access (PR:L) prevents a higher score, but in practice, initial compromise via phishing or lateral movement can provide the necessary credentials, making this a significant escalation path.

Frequently asked questions