CVE-2026-7770: IBM i Access Client Solutions RCE Flaw

CVE-2026-7770 Overview

CVE-2026-7770 is a remote code execution vulnerability in IBM i Access Client Solutions (ACS) versions 1.1.5.0 through 1.1.9.12. The flaw is exposed when ACS is configured to listen for requests from IBM i Navigator. An authenticated attacker with network access can send crafted requests to the listening service to execute arbitrary code on the host. The weakness is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component, or Injection).

Critical Impact
Successful exploitation grants attackers code execution on systems running vulnerable ACS configurations, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

IBM i Access Client Solutions (ACS) version 1.1.5.0
IBM i Access Client Solutions (ACS) versions 1.1.5.1 through 1.1.9.11
IBM i Access Client Solutions (ACS) version 1.1.9.12

Discovery Timeline

2026-06-01 - CVE-2026-7770 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-7770

Vulnerability Analysis

IBM i Access Client Solutions is a Java-based client that provides access to IBM i resources, including 5250 emulation, data transfer, and database operations. When ACS is configured to accept inbound requests from IBM i Navigator, it exposes a network-facing listener. The vulnerability stems from improper neutralization of attacker-controlled input received by this listener, allowing injection of executable content into a downstream component. An attacker with low-privilege network access can deliver a crafted request that the listener processes without adequate validation, resulting in arbitrary code execution within the context of the ACS process.

Root Cause

The root cause is an injection weakness ([CWE-74]) in the request-handling path used when ACS listens for IBM i Navigator traffic. Input received over the network is passed to a downstream interpreter or execution context without sufficient sanitization or output encoding. This allows control characters or payload elements to alter the intended command or data structure, breaking the trust boundary between input parsing and execution.

Attack Vector

Exploitation requires network reachability to the ACS listener and low-privilege authentication. No user interaction is needed. An attacker submits a malformed or maliciously structured request to the IBM i Navigator listening port on the ACS host. The injected payload is interpreted by the downstream component, causing the targeted process to execute attacker-supplied logic. Verified exploit code is not publicly available at the time of publication, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.231%.

No verified proof-of-concept code is available. Refer to the IBM Support Page for vendor-supplied technical details.

Detection Methods for CVE-2026-7770

Indicators of Compromise

Unexpected child processes spawned by the ACS Java runtime (acslaunch_win-64.exe, java.exe invoking ACS jars) on endpoints with ACS installed.
Inbound connections to the ACS listener port from hosts that are not authorized IBM i Navigator servers.
New or modified files written by the ACS process into user-writable directories outside its normal working paths.

Detection Strategies

Inventory all endpoints running IBM i Access Client Solutions and identify which have the IBM i Navigator listener feature enabled.
Hunt for anomalous process trees originating from ACS, particularly script interpreters (cmd.exe, powershell.exe, /bin/sh) launched as children of the ACS Java process.
Correlate authentication events with ACS listener connections to identify low-privilege accounts initiating unusual request patterns.

Monitoring Recommendations

Enable verbose logging on the ACS listener and forward logs to a centralized SIEM for retention and correlation.
Monitor network flow data for connections to ACS listener ports from unexpected source addresses.
Alert on ACS configuration changes that enable the IBM i Navigator listener on previously non-listening endpoints.

How to Mitigate CVE-2026-7770

Immediate Actions Required

Identify all installations of IBM i Access Client Solutions in versions 1.1.5.0 through 1.1.9.12 and prioritize patching.
Disable the IBM i Navigator listening configuration on ACS clients that do not require it until a patched version is deployed.
Restrict network access to ACS listener ports using host-based firewall rules so only authorized IBM i Navigator servers can connect.

Patch Information

IBM has published guidance for this vulnerability. Consult the IBM Support Page for the fixed release version and download instructions. Apply the vendor-supplied update to all affected endpoints and validate version metadata after deployment.

Workarounds

Turn off the ACS option that listens for requests from IBM i Navigator where the integration is not required for business operations.
Enforce network segmentation so ACS endpoints are not reachable from untrusted networks or general user VLANs.
Require strong authentication and least-privilege accounts for any user able to reach ACS listener services, reducing the population of accounts that meet the low-privilege precondition for exploitation.

bash

# Example: block inbound traffic to ACS listener except from a trusted IBM i Navigator host
# Replace <ACS_LISTENER_PORT> and <NAVIGATOR_HOST_IP> with environment-specific values
netsh advfirewall firewall add rule name="Block ACS Listener" \
    dir=in action=block protocol=TCP localport=<ACS_LISTENER_PORT>

netsh advfirewall firewall add rule name="Allow Navigator to ACS" \
    dir=in action=allow protocol=TCP localport=<ACS_LISTENER_PORT> \
    remoteip=<NAVIGATOR_HOST_IP>