CVE-2026-13094CWE-94code-injection

CVE-2026-13094

High · published August 13, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00200 · 9.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-13T01:17Z
Affected products (1)
ProductVersionsFixed in
ibm/i_access_client_solutions≥ 1.1.2, < 1.1.9.141.1.9.14
References (1)
https://www.ibm.com/support/pages/node/7282954 · [email protected]
EPSS history
Timeline
  • 12 AUG 20:45Z
    IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
    cvelistv5