IBM I Access Client Solutions vulnerabilities

12 CVEs affecting IBM I Access Client Solutions, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-14875, published 2026-08-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-45184, published 2023-12-14. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. IBM X-Force ID: 268270.
CVE-2023-45185, published 2023-12-14. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code. Due to improper authority checks the attacker could perform operations…
CVE-2026-7770, published 2026-06-01. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. IBM i Access Family 1.1.5.0 through 1.1.9.12 IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator.
CVE-2023-45182, published 2023-12-14. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow gaining access to the encrypted password,…
CVE-2024-22318, published 2024-02-09. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS…
CVE-2026-13105, published 2026-08-12. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when importing a configuration.
CVE-2022-40746, published 2022-11-21. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking…
CVE-2026-16695, published 2026-08-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
CVE-2026-13094, published 2026-08-12. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable configuration file.
CVE-2026-13433, published 2026-08-12. Critical severity, CVSS 9.6. EPSS: 0.2% chance of exploitation in the next 30 days. IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to…

Latest

CVE-2026-14875, published 2026-08-13. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable directory.
CVE-2026-14866, published 2026-08-12. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore.