← Vulnerability feed

Vulnerability record · CVE-2026-13433 · published 12 August 2026

CVE-2026-13433: Ibm i access client solutions download of code without integrity check vulnerability

Ibm · I Access Client Solutions

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation.

9.6 CVSS 3.1 Critical EPSS 0.17% · top 94.2% CWE-494 · Download of code without integrity check
9.6CVSS 3.1 base score
0.17%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
18 Aug 2026Last modified by NVD

Description

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7282954 Vendor Advisory

Track CVE-2026-13433 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-13105Ibm i access client solutions path traversal vulnerabilityIBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration.EPSS 0.50%8.8CVE-2026-7770Ibm i access client solutions injection vulnerabilityIBM i Access Family 1.1.5.0 through 1.1.9.12 IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for…EPSS 0.81%8.8CVE-2023-45185Ibm i access client solutions incorrect authorization vulnerabilityIBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code. Due to improper authori…EPSS 0.99%7.8CVE-2026-14875Ibm i access client solutions untrusted search path vulnerabilityIBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publi…EPSS 0.17%7.8CVE-2026-16695Ibm i access client solutions os command injection vulnerabilityIBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbitrary code due to improper neutralization of speci…EPSS 0.21%7.8CVE-2026-13094Ibm i access client solutions code injection vulnerabilityIBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publi…EPSS 0.20%7.5CVE-2023-45184Ibm i access client solutions vulnerabilityIBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper auth…EPSS 1.6%7.1CVE-2026-14866Ibm i access client solutions hard-coded credentials vulnerabilityIBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore.EPSS 0.11%

Source: NIST National Vulnerability Database (record CVE-2026-13433), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.