Description

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-13T20:17:14.390Z",
  "pubdate": "2026-08-13T20:17:14.390Z",
  "executiveSummary": "IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 contain an arbitrary code execution vulnerability affecting Windows installations deployed for all users. The vulnerability stems from an insecurely configured, publicly writeable installation directory created during the setup process. This security flaw introduces significant risk to host systems, allowing unprivileged local adversaries to compromise the integrity and confidentiality of the affected operating environment.\nAn attacker with local access and standard user privileges can leverage the insecure permissions of the installation directory to execute arbitrary code within the context of other users, including potentially elevated or administrative accounts. Exploitation requires the attacker to have prior local access to the target Windows system and relies on interacting with the vulnerable directory structure. Successful exploitation leads to local privilege escalation or arbitrary code execution, undermining the security posture of the host system running the affected IBM i Access Client Solutions software.",
  "technicalDetails": "The root cause of the vulnerability resides in the overly permissive access control lists (ACLs) assigned to the installation directory when IBM i Access Client Solutions is installed for all users on the Windows operating system. Specifically, the directory is provisioned with publicly writeable permissions, granting non-administrative local users the ability to modify, create, or replace files within the application path.\nThe vulnerable component is the Windows multi-user installation routine and the resulting directory structure of IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13. Authentication requirements for exploitation are minimal, requiring only local interactive or programmatic access to the host system with standard user privileges. No network exposure or remote attack vector is inherently required, as the flaw is bound to local file system permissions.\nThe attack flow proceeds as follows: First, an unprivileged local attacker identifies a Windows system where IBM i Access Client Solutions has been installed for all users. Second, the attacker navigates to the publicly writeable installation directory. Third, leveraging the improper write permissions, the attacker places a malicious payload, such as a crafted Dynamic Link Library (DLL) or executable targeted by the application during normal execution or startup, into the directory. Alternatively, the attacker may overwrite legitimate application binaries or components.\nWhen a legitimate user or administrative account subsequently launches the application or triggers the execution of the compromised component, the operating system executes the attacker-supplied payload with the privileges of the executing user. The payload behavior depends on the attacker's design, which can range from establishing local persistence, executing arbitrary commands, to achieving local privilege escalation if executed by a higher-privileged user or service account. Post-exploitation impact includes full compromise of the local application context and potential lateral movement or broader system compromise depending on the user context that executes the modified application assets."
}