Description

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-12T21:17:34.900Z",
  "pubdate": "2026-08-12T21:17:34.900Z",
  "executiveSummary": "IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 contain an arbitrary code execution vulnerability affecting Windows environments where the software is installed for all users. The root cause stems from the presence of a publicly writeable configuration file utilized during the execution lifecycle of the application. This security flaw allows unprivileged local threat actors to modify critical configuration parameters or substitute referenced binaries and scripts processed by the application.\nThe primary impact of successful exploitation is the execution of arbitrary code with the privilege level of the user context running the affected application, which may include administrative privileges depending on how the software is invoked or scheduled. This poses severe risk implications, including full local system compromise, persistence establishment, and potential lateral movement within the network. The attacker capabilities are constrained primarily to local access requirements, leveraging improper access control permissions on shared installation directories or configuration artifacts. Exploitation requires no advanced cryptographic bypasses, relying strictly on standard filesystem modification capabilities inherent to insecurely configured multi-user Windows deployments.",
  "technicalDetails": "The vulnerability resides in the access control list (ACL) configuration assigned during the installation of IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 when deployed in an all-users installation mode on Microsoft Windows operating systems. Specifically, the installer improperly assigns overly permissive discretionary access control lists (DACLs) to application configuration files or associated directories, granting modify or write permissions to low-privileged or standard authenticated users.\nThe root cause is an insecure file permission flaw where critical configuration data or execution targets are stored within a publicly writeable directory or file path. During standard operational flows, the application reads and processes these configuration files, occasionally executing referenced scripts, binaries, or libraries without validating their integrity, origin, or file system permissions.\nThe step-by-step attack flow proceeds as follows: First, a local attacker with standard user privileges identifies the insecurely permissioned configuration file located within the IBM i Access Client Solutions installation path. Second, the attacker leverages standard Windows filesystem APIs to overwrite, append to, or modify the configuration file, or replaces an expected dependent script or binary with a malicious payload. Third, when a legitimate user or an automated administrative process launches IBM i Access Client Solutions, the application reads the manipulated configuration file or attempts to execute the compromised referenced component. Finally, because the application executes with the security context of the user running the process, the embedded malicious payload is executed, resulting in arbitrary code execution on the target Windows system.\nAuthentication and privilege requirements are minimal for the exploitation vector: the attacker must have interactive or programmatic local access to the Windows endpoint with standard user privileges, and the software must be installed in the vulnerable all-users configuration. The vulnerability does not require network exposure for remote exploitation, classifying it strictly as a local privilege escalation or local code execution vector. Post-exploitation impact includes unauthorized execution of arbitrary commands, installation of persistent backdoors, harvesting of user credentials, and potential escalation to higher privilege levels if administrative processes interact with the compromised application."
}