CVE-2026-14866: IBM i Access Client Solutions CA Injection

CVE-2026-14866 Overview

CVE-2026-14866 affects IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.13. The product ships with a publicly writable truststore, allowing a local attacker to inject a rogue certificate authority (CA). Once a rogue CA is trusted, the attacker can forge certificates that ACS validates as legitimate. This enables man-in-the-middle interception of encrypted sessions between the client and IBM i systems. The weakness maps to CWE-798-adjacent trust store misconfiguration and is tracked by IBM in their security advisory.

Critical Impact
A local attacker who can write to the ACS truststore can add an attacker-controlled CA, defeat TLS certificate validation, and intercept or modify traffic to IBM i systems.

Affected Products

IBM i Access Client Solutions 1.1.2.0
IBM i Access Client Solutions versions between 1.1.2.0 and 1.1.9.13
IBM i Access Client Solutions 1.1.9.13

Discovery Timeline

2026-08-12 - CVE-2026-14866 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-14866

Vulnerability Analysis

IBM i Access Client Solutions is a Java-based client that connects Windows, macOS, and Linux workstations to IBM i (formerly AS/400) systems. The client bundles its own truststore to validate TLS certificates presented by IBM i hosts, database services, and 5250 emulator sessions.

The flaw stems from filesystem permissions on the ACS truststore. The truststore file is created with world-writable permissions, so any local user on the host can modify it. An attacker who imports a self-signed root CA into that truststore causes ACS to trust any certificate signed by that CA.

With a trusted rogue CA in place, an attacker positioned on the network can present forged certificates for IBM i endpoints. ACS accepts them as valid, breaking the confidentiality and integrity guarantees of TLS. Credentials, SQL result sets, and 5250 emulator traffic become readable to the attacker.

Root Cause

The root cause is insecure default filesystem permissions on the ACS truststore. Trust anchors are security-critical material and must be writable only by privileged accounts. Granting write access to all local users allows unprivileged tampering with the chain of trust.

Attack Vector

Exploitation requires local access to a workstation running a vulnerable ACS version. No authentication to ACS itself is required, and no user interaction is needed. The attacker writes a rogue CA certificate into the truststore, then performs network interception against IBM i traffic from that host. Refer to the IBM Security Advisory for vendor-supplied technical detail.

Detection Methods for CVE-2026-14866

Indicators of Compromise

Unexpected root CA entries in the ACS truststore that do not match the organization's approved CA list.
Truststore file modification timestamps that do not align with ACS installation or patch events.
ACS truststore files with world-writable permissions on Windows, macOS, or Linux endpoints.

Detection Strategies

Enumerate the ACS truststore on managed workstations and compare its contents against a known-good baseline of trusted CAs.
Audit filesystem permissions on the ACS installation directory and truststore path, flagging entries that grant write access to non-administrative users.
Correlate TLS session anomalies to IBM i hosts, such as unexpected certificate issuers, with recent truststore write events on the client.

Monitoring Recommendations

Monitor file integrity on the ACS truststore and alert on modifications by non-administrative processes or accounts.
Log ACS version inventory across the fleet and flag hosts still running versions in the 1.1.2.0 through 1.1.9.13 range.
Capture certificate metadata from TLS connections to IBM i systems and alert on issuers not present in the enterprise PKI.

How to Mitigate CVE-2026-14866

Immediate Actions Required

Upgrade IBM i Access Client Solutions to a fixed release as identified in the IBM Security Advisory.
Inventory all endpoints running ACS versions 1.1.2.0 through 1.1.9.13 and prioritize remediation on shared or multi-user hosts.
Review the ACS truststore on each host and remove any CA entries that are not part of the approved trust list.

Patch Information

IBM has published remediation guidance in security advisory node 7282954. Apply the vendor-provided fixed version of IBM i Access Client Solutions to correct the truststore permissions and remove the ability for unprivileged users to inject CA certificates.

Workarounds

Restrict filesystem permissions on the ACS truststore so that only administrators or the SYSTEM account can write to it.
Limit local logon rights on workstations that run ACS, especially those used to administer IBM i systems.
Deploy the ACS truststore from a read-only, centrally managed location and enforce configuration with endpoint management tooling.

bash

# Configuration example: restrict truststore permissions on Windows and Linux
# Windows (PowerShell) - remove write access for standard Users on the ACS truststore
icacls "C:\Users\Public\IBM\ClientSolutions\Documents\cwbssldf.kdb" /inheritance:r
icacls "C:\Users\Public\IBM\ClientSolutions\Documents\cwbssldf.kdb" /grant:r "Administrators:(F)" "SYSTEM:(F)" "Users:(R)"

# Linux - set root-owned, read-only for non-privileged users
sudo chown root:root /opt/ibm/iaccess/truststore
sudo chmod 644 /opt/ibm/iaccess/truststore