Attack Chain

1. Attacker establishes local access to a Windows system where IBM i Access Client Solutions is installed for all users.
2. Attacker enumerates the ACS installation directory and subdirectories to locate configuration files.
3. Attacker identifies a configuration file with weak discretionary access control lists (DACLs) permitting non-administrative write access.
4. Attacker modifies the configuration file to include malicious commands or point to a malicious library/script.
5. An authorized user (or elevated service) launches the IBM i Access Client Solutions application.
6. The application parses the malicious configuration file during initialization.
7. The application executes the injected code or triggers the malicious path during runtime.
8. Final objective is achieved: execution of arbitrary code in the context of the user running the application.

Impact

Successful exploitation allows a local attacker to execute arbitrary code on the affected Windows system. This can lead to local privilege escalation, persistence, or data theft, depending on the privileges of the user executing the application. The vulnerability affects all deployments of IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 installed in a multi-user context.

Recommendation

Prioritized actions for security teams:

• Update IBM i Access Client Solutions to a patched version as advised by the vendor in the official support bulletin (CVE-2026-13094).
• Use File Integrity Monitoring (FIM) or audit logs to detect unauthorized modifications to application configuration files in 'C:\ProgramData' or 'C:\Program Files'.
• Review the permissions of the configuration files for IBM software to ensure they are restricted to Administrators and SYSTEM accounts.