CVE-2026-14275 Overview
CVE-2026-14275 is a command injection vulnerability in IBM i Access Client Solutions, part of the IBM i Access Family. The flaw affects versions 1.1.2.0 through 1.1.9.15 and stems from improper validation of user-supplied input in the STRPCCMD CL command. An authenticated user can leverage the weakness to execute arbitrary commands on the target system with normal user privileges. The issue is tracked under CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Critical Impact
Authenticated attackers can execute arbitrary operating system commands through the STRPCCMD CL command, expanding their foothold within an IBM i environment.
Affected Products
- IBM i Access Client Solutions version 1.1.2.0
- IBM i Access Client Solutions versions 1.1.3.0 through 1.1.9.14
- IBM i Access Client Solutions version 1.1.9.15
Discovery Timeline
- 2026-09-14 - CVE-2026-14275 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-14275
Vulnerability Analysis
The vulnerability resides in how IBM i Access Client Solutions handles input passed to the STRPCCMD (Start PC Command) CL command. STRPCCMD is designed to run a personal computer command from an IBM i session, bridging server-issued instructions to the client workstation. Because the client fails to properly neutralize special characters in the supplied command string, an authenticated user can inject additional operating system commands that execute in the context of the local user session.
Successful exploitation grants command execution with the privileges of the normal user running the client. This can be used to run local tools, drop follow-on payloads, or pivot toward higher-value systems reachable from the workstation. The attack vector is network-based, but valid authentication is required, which limits opportunistic exploitation.
Root Cause
The root cause is improper input validation [CWE-78] in the STRPCCMD handler. The client accepts command strings without sufficiently sanitizing shell metacharacters or delimiters, allowing injected content to be interpreted as separate commands by the underlying operating system shell.
Attack Vector
An attacker with valid credentials issues a crafted STRPCCMD invocation containing embedded command separators or shell metacharacters. When the IBM i Access Client Solutions component processes the request on the client workstation, the injected payload is executed. Refer to the IBM Support advisory for node 7287166 for vendor technical details.
// No verified proof-of-concept code is available for CVE-2026-14275.
// See the IBM Support advisory for technical details:
// https://www.ibm.com/support/pages/node/7287166
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-14275
Indicators of Compromise
- Unexpected STRPCCMD invocations originating from user sessions that do not typically issue PC commands.
- Child processes spawned by IBM i Access Client Solutions that launch shells (cmd.exe, powershell.exe) or scripting hosts.
- Command strings passed to STRPCCMD containing shell metacharacters such as &, |, ;, or backticks.
Detection Strategies
- Enable IBM i job and command logging to capture STRPCCMD usage, including the full command parameter values.
- Correlate endpoint process creation telemetry on workstations running IBM i Access Client Solutions with concurrent IBM i session activity.
- Alert on process lineage where acsnative.exe or related IBM i Access Client Solutions binaries spawn interpreters or administrative utilities.
Monitoring Recommendations
- Baseline normal STRPCCMD traffic per user and flag deviations in frequency or command content.
- Forward workstation EDR telemetry and IBM i audit journals to a central data lake for cross-source correlation.
- Monitor authentication events tied to IBM i user profiles for anomalous logins that precede STRPCCMD activity.
How to Mitigate CVE-2026-14275
Immediate Actions Required
- Inventory all workstations running IBM i Access Client Solutions and identify installations within the affected 1.1.2.0 through 1.1.9.15 range.
- Apply the fixed release published by IBM as referenced in the IBM Support advisory.
- Restrict IBM i user profiles from executing STRPCCMD where the capability is not required for business operations.
Patch Information
IBM has published remediation guidance and fix availability information in IBM Support node 7287166. Administrators should upgrade IBM i Access Client Solutions to the vendor-provided fixed version.
Workarounds
- Limit authority to the STRPCCMD CL command through IBM i object authority controls until patches are deployed.
- Enforce least-privilege on Windows workstations so that any injected commands run with minimal capability.
- Segment workstations that run IBM i Access Client Solutions from sensitive network zones to constrain post-exploitation movement.
# Example: revoke public authority to STRPCCMD on IBM i
RVKOBJAUT OBJ(QSYS/STRPCCMD) OBJTYPE(*CMD) USER(*PUBLIC) AUT(*ALL)
GRTOBJAUT OBJ(QSYS/STRPCCMD) OBJTYPE(*CMD) USER(TRUSTED_GRP) AUT(*USE)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
