CVE-2026-13433

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7282954	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:i_access_client_solutions:*:*:*:*:*:*:*:*

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) IBM i Access Client Solutions 1.1.2.0 hasta 1.1.9.13 (ACS) es vulnerable a la descarga de código de producto no verificado cuyo está configurado para actualizar desde un IBM i. Un actor malicioso podría usar esta vulnerabilidad para ejecutar código comprometido en la estación de trabajo del usuario de ACS.

Information

Published : 2026-08-12 21:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-13433

Mitre link : CVE-2026-13433

CVE.ORG link : CVE-2026-13433

JSON object : View

Products Affected

ibm

i_access_client_solutions

CWE

CWE-494

Download of Code Without Integrity Check

{"id": "CVE-2026-13433", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13433", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-13T14:08:41.054578Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:i_access_client_solutions:1.1.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i_access_client_solutions:1.1.9.13:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "i Access Client Solutions", "versions": [{"status": "affected", "version": "1.1.2.0", "versionType": "semver", "lessThanOrEqual": "1.1.9.13"}]}]}], "published": "2026-08-12T21:17:35.380", "references": [{"url": "https://www.ibm.com/support/pages/node/7282954", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-494"}]}], "descriptions": [{"lang": "en", "value": "IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation."}, {"lang": "es", "value": "IBM i Access Client Solutions 1.1.2.0 hasta 1.1.9.13 (ACS) es vulnerable a la descarga de c\u00f3digo de producto no verificado cuyo est\u00e1 configurado para actualizar desde un IBM i. Un actor malicioso podr\u00eda usar esta vulnerabilidad para ejecutar c\u00f3digo comprometido en la estaci\u00f3n de trabajo del usuario de ACS."}], "lastModified": "2026-10-23T19:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:i_access_client_solutions:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A42F6403-AF4A-46D1-B525-27111BA28FC9", "versionEndExcluding": "1.1.9.14", "versionStartIncluding": "1.1.2"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}