CVE-2026-13094 Overview
CVE-2026-13094 affects IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 on Windows. The vulnerability allows arbitrary code execution when the software is installed for all users. A publicly writeable configuration file lets a local, low-privileged attacker modify configuration data that the application processes. This condition maps to improper control of code generation [CWE-94]. Successful exploitation compromises confidentiality, integrity, and availability of the affected host.
Critical Impact
A local attacker with low privileges can modify a world-writeable configuration file to execute arbitrary code in the context of users running IBM i Access Client Solutions on Windows.
Affected Products
- IBM i Access Client Solutions 1.1.2.0 on Windows (all-users installation)
- IBM i Access Client Solutions versions between 1.1.2.0 and 1.1.9.13 on Windows
- IBM i Access Client Solutions 1.1.9.13 on Windows (all-users installation)
Discovery Timeline
- 2026-08-12 - CVE CVE-2026-13094 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-13094
Vulnerability Analysis
IBM i Access Client Solutions is a Java-based client used to interact with IBM i systems. When the product is installed for all users on Windows, the installer creates a shared configuration file that is writeable by unprivileged local users. Because the application reads this configuration during normal execution, an attacker who modifies the file can influence application behavior and inject code paths that the client subsequently executes.
The issue is a local privilege boundary failure. Any user on the Windows host can alter the shared configuration to reference attacker-controlled resources or code. When another user, potentially with higher privileges, launches the client, the tampered configuration is processed and the injected content runs in that user's session.
Root Cause
The root cause is insecure default permissions on the shared configuration file created during all-users installation. The installer does not restrict write access to administrators, leaving a low-integrity file within a high-integrity code path. This falls under [CWE-94] Improper Control of Generation of Code because attacker-supplied configuration data alters what the client executes.
Attack Vector
Exploitation requires local access and low privileges on the target Windows host. No user interaction is needed from the attacker's perspective beyond writing to the configuration file. The payload triggers when a legitimate user next runs IBM i Access Client Solutions. If that user holds administrative rights, the attacker gains code execution at the higher privilege level, enabling privilege escalation. Consult the IBM Support Page for the vendor's technical description of the attack surface.
Detection Methods for CVE-2026-13094
Indicators of Compromise
- Unexpected modifications to IBM i Access Client Solutions configuration files under the shared install directory (for example, C:\Users\Public\IBM\ClientSolutions\).
- New or unfamiliar file paths, JAR references, or plugin entries appearing in the client configuration.
- Child processes spawned by acslaunch_win-64.exe or java.exe (invoked by the client) that write to sensitive locations or initiate outbound network connections.
Detection Strategies
- Monitor file integrity on the IBM i Access Client Solutions installation directory and flag writes by non-administrative users.
- Alert on process lineage where IBM i Access Client Solutions launches unexpected binaries such as cmd.exe, powershell.exe, or rundll32.exe.
- Compare configuration file ACLs against a hardened baseline and identify hosts where the file grants write access to Users or Authenticated Users.
Monitoring Recommendations
- Enable Windows object access auditing on the shared IBM ACS configuration directory and forward events to a central SIEM.
- Track installed versions of IBM i Access Client Solutions across the fleet and flag hosts still running versions in the vulnerable range 1.1.2.0 through 1.1.9.13.
- Review scheduled tasks and startup entries on hosts running IBM ACS for persistence artifacts referencing the client.
How to Mitigate CVE-2026-13094
Immediate Actions Required
- Inventory all Windows systems running IBM i Access Client Solutions and identify installations performed in all-users mode.
- Apply the fixed release provided by IBM as referenced on the IBM Support Page.
- Restrict write permissions on the shared configuration file and directory to administrators only until patching is complete.
Patch Information
IBM has published remediation guidance on the IBM Support Page. Upgrade IBM i Access Client Solutions to a version beyond 1.1.9.13 that addresses the insecure permissions on the shared configuration file. Re-run the installer or apply vendor-provided permission fixes after upgrading to ensure existing files inherit the corrected ACLs.
Workarounds
- Reinstall IBM i Access Client Solutions in per-user mode to eliminate the shared writeable configuration file.
- Manually apply restrictive NTFS permissions to the configuration file so only SYSTEM and Administrators have write access.
- Limit interactive logon on hosts running the client to trusted users while patch deployment is in progress.
# Configuration example: restrict ACLs on the shared IBM ACS configuration directory
icacls "C:\Users\Public\IBM\ClientSolutions" /inheritance:r
icacls "C:\Users\Public\IBM\ClientSolutions" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Users:(OI)(CI)RX"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
