CVE-2026-16695: IBM i Access Client Solutions RCE Flaw

CVE-2026-16695 Overview

CVE-2026-16695 is a command injection vulnerability in IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.13. The flaw stems from improper neutralization of special elements passed to an operating system command [CWE-78]. A local attacker who convinces a user to interact with a crafted input can execute arbitrary code in the context of the running application. IBM published advisory details at IBM Support Node 7282954.

Critical Impact
Successful exploitation allows a local attacker to run arbitrary OS commands with the privileges of the ACS user, compromising confidentiality, integrity, and availability of the host.

Affected Products

IBM i Access Client Solutions 1.1.2.0
IBM i Access Client Solutions versions between 1.1.2.0 and 1.1.9.13
IBM i Access Client Solutions 1.1.9.13

Discovery Timeline

2026-08-12 - CVE-2026-16695 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-16695

Vulnerability Analysis

IBM i Access Client Solutions is a Java-based client used by administrators and end users to connect to IBM i systems. The vulnerability arises when the application invokes an operating system command using input that is not adequately sanitized. An attacker who supplies specially crafted content can inject shell metacharacters that break out of the intended command and execute additional attacker-controlled commands.

Exploitation is local and requires user interaction, per the CVSS attack vector. The impact scope remains unchanged, but confidentiality, integrity, and availability are each fully compromised because arbitrary code executes with the same privileges as the ACS process. Enterprises that deploy ACS on administrator workstations are particularly exposed, since those users often hold elevated credentials to IBM i systems.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The vulnerable code path constructs a command string that concatenates untrusted input without escaping shell metacharacters or using a safe API that separates the executable from its arguments. IBM's advisory at IBM Support Node 7282954 documents affected versions and the corrective release.

Attack Vector

An attacker delivers a crafted file, URL, or configuration input to a user of IBM i Access Client Solutions. When the user opens or processes the input through ACS, the injected metacharacters cause the underlying shell to execute additional commands. Because the vector is local with required user interaction, exploitation typically pairs with phishing or supply-chain delivery of the malicious artifact.

No verified public proof-of-concept is available at the time of writing. See the vendor advisory for technical details.

Detection Methods for CVE-2026-16695

Indicators of Compromise

Unexpected child processes spawned by the ACS Java runtime (java.exe or javaw.exe) such as cmd.exe, powershell.exe, or /bin/sh.
ACS process launching binaries outside its normal installation directory or writing executables to user-writable paths.
Outbound network connections initiated by processes descended from the ACS client shortly after opening a file or link.

Detection Strategies

Build endpoint detection rules that flag process-tree anomalies where IBM i Access Client Solutions spawns command interpreters or scripting hosts.
Correlate file-open events for ACS-associated file types with subsequent short-lived shell invocations.
Hunt for command lines containing shell metacharacters (;, |, &&, backticks) in arguments passed to ACS-launched processes.

Monitoring Recommendations

Inventory endpoints running ACS versions 1.1.2.0 through 1.1.9.13 using software asset management data.
Forward process-creation, image-load, and command-line telemetry from ACS hosts to a centralized analytics platform for retention and hunting.
Alert on any privilege-sensitive activity performed by user accounts that operate ACS, including new local account creation or credential access attempts.

How to Mitigate CVE-2026-16695

Immediate Actions Required

Upgrade IBM i Access Client Solutions to the fixed release documented in IBM Support Node 7282954.
Identify and prioritize administrator workstations that use ACS to manage IBM i systems, as compromise there yields the highest impact.
Restrict which file types and URL handlers can invoke ACS on end-user machines until patching is complete.

Patch Information

IBM has published remediation guidance in the vendor advisory at IBM Support Node 7282954. Administrators should apply the vendor-supplied fixed version that supersedes 1.1.9.13 and validate that all endpoints have been updated. Reimage or revalidate any host suspected of executing untrusted input through a vulnerable ACS version.

Workarounds

Limit ACS usage to trusted administrators and enforce least privilege on workstations where it is installed.
Block delivery of untrusted ACS configuration files and shortcuts through email and web gateways.
Apply application-control policies that prevent the ACS Java runtime from spawning command interpreters.

bash

# Example: query installed ACS version on Windows endpoints
reg query "HKLM\SOFTWARE\IBM\Client Access Solutions" /v Version