CVE-2026-14875 in i Access Client Solutions
Summary
by MITRE • 08/13/2026
IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable directory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists in IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 where the installation process creates directories with insufficient access controls when configured for all users on Windows systems. The flaw stems from improper privilege escalation during the installation routine, specifically allowing local attackers to write to critical system directories that should remain protected. When installed system-wide, the software creates writable directories that can be exploited by malicious actors to place malicious code in locations where it will execute with elevated privileges during normal system operations.
The technical implementation of this vulnerability involves a path traversal and privilege escalation flaw within the Windows installer component. Attackers can leverage the publicly writeable directory permissions to inject malicious DLL files or executable code into the installation path, which then executes with the privileges of the target user. This represents a classic privilege escalation vulnerability that maps to CWE-276, specifically concerning incorrect permissions for critical resources. The vulnerability operates at the file system level where standard Windows security controls are bypassed due to inadequate access control list (ACL) configuration during installation.
The operational impact of this vulnerability extends beyond simple code execution as it provides attackers with persistent access to compromised systems. Once executed, malicious code can establish backdoors, exfiltrate data, or serve as a foothold for further attacks within the network infrastructure. The attack vector is particularly concerning because it requires minimal privileges to exploit and can be automated through social engineering or by leveraging existing access to the target system. This vulnerability directly relates to ATT&CK technique T1068 which covers locally executed malicious code and T1547 which addresses boot or logon initialization scripts.
Mitigation strategies should focus on immediate privilege restrictions and access control enforcement. System administrators must ensure that installation directories are properly configured with restrictive permissions, preventing write access to critical system paths. The recommended approach includes disabling the all-users installation option or implementing proper ACL controls during the installation process. Additionally, regular security audits should verify directory permissions and implement automated monitoring for unauthorized file modifications in critical system locations. Organizations should also consider implementing application whitelisting policies to prevent execution of unauthorized code, while maintaining detailed logging of installation activities and file system changes in accordance with NIST SP 800-171 requirements for protecting controlled unclassified information.