CVE-2026-13094

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I Access Client Solutions

CVE-2026-13105

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I Access Client Solutions

CVE-2026-13367

IBM Informix Dynamic Server Privilege Escalation Vulnerability in oninit Utility

IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit setuid-root utility.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Hp Ibm and 4 more

Products

Ubuntu Linux Hp-ux Aix and 6 more

CVE-2026-13433

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I Access Client Solutions

CVE-2026-11383

Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Aix I Tivoli System Automation Application Manager and 4 more

CVE-2026-11707

Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Aix I Tivoli System Automation Application Manager and 4 more

CVE-2026-16982

IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a heap buffer overflow.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-16887

IBM i is Affected By A Denial of Service Vulnerability DST/SST []

IBM i 7.6 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-16861

IBM i is Affected By Multiple Vulnerabilities in NetServer

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-17045

IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-16929

IBM i is Affected By Multiple Vulnerabilities in Host Servers

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-10571

IBM WebSphere Application Server Liberty is affected by a denial of service

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Linux and 1 more

Products

Macos Aix I and 6 more

CVE-2026-14875

IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable directory.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I Access Client Solutions

CVE-2026-14525

IBM WebSphere Application Server Liberty is affected by an authenication bypass

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Linux and 1 more

Products

Macos Aix I and 5 more

CVE-2026-17111

IBM i is Affected By Multiple Vulnerabilities in SQL

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-17417

IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-17642

IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-18148

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log files due to improper output neutralization for logs.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-18150

IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2026-16867

IBM i is Affected By Multiple Vulnerabilities in NetServer

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I