VYPR
← All advisories
High severity8.8NVD Advisory· Published Jun 1, 2026

CVE-2026-7770

CVE-2026-7770

Description

IBM i Access Client Solutions (ACS) versions 1.1.5.0 through 1.1.9.12 are vulnerable to RCE when configured to listen for IBM i Navigator requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

IBM i Access Client Solutions (ACS) versions 1.1.5.0 through 1.1.9.12 are vulnerable to RCE when configured to listen for IBM i Navigator requests.

Vulnerability

IBM i Access Client Solutions (ACS) versions 1.1.5.0 through 1.1.9.12 are vulnerable to remote code execution when configured to listen for requests from IBM i Navigator. This vulnerability is related to improper neutralization of special elements in output used by a downstream component [1].

Exploitation

An attacker with lower privileges can exploit this vulnerability by sending specially crafted requests to the IBM i Access Client Solutions (ACS) application when it is configured to listen for requests from IBM i Navigator. Network access is required, and no user interaction is necessary [1].

Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution with high confidentiality, integrity, and availability impacts. The scope of the compromise is the user's system [1].

Mitigation

There are no workarounds or mitigations available for this vulnerability. Users are advised to update to a fixed version once available. The affected versions are IBM i Access Family 1.1.5.0 through 1.1.9.12 [1].

References
  1. Security Bulletin: IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator (CVE-2026-7770)

AI Insight generated on Jun 1, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

2

Patches

0

No patches discovered yet.

Vulnerability mechanics

No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.

References

1

News mentions

0

No linked articles in our index yet.