CVE-2024-22318

IBM i Access Client Solutions (ACS) versions 1.1.2–1.1.4 and 1.1.4.3–1.1.9.4 are vulnerable to NTLM hash disclosure. An attacker can modify UNC-capable paths in ACS configuration files to point to a hostile server; if NTLM is enabled on the Windows workstation, the OS will attempt to authenticate...

CVE-2026-13105

CVE-2026-13105 affects IBM i Access Client Solutions (ACS) versions 1.1.2.0–1.1.9.13. The vulnerability is a zip slip/path traversal issue that occurs when importing a configuration, arising from improper handling of archive paths. Impact is high (C:H/I:H/A:H) as per IBM’s CVSS vector, with netwo...

CVE-2022-40746

CVE-2022-40746 affects IBM i Access Client Solutions (IBM i Access Family) versions 1.1.2–1.1.4 and 1.1.4.3–1.1.9.0. The root cause is a DLL search order hijacking vulnerability that could allow a local authenticated attacker to execute arbitrary code by placing a specially crafted file in a comp...

CVE-2023-45185

CVE-2023-45185 concerns IBM i Access Client Solutions. Affected versions are 1.1.2–1.1.4 and 1.1.4.3–1.1.9.3. The issue arises from improper authority checks and insecure deserialization of network packets or user data, enabling a remote attacker to execute code under the user’s PC context. Red H...

CVE-2026-16695

IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.13 are affected by CVE-2026-16695, a local code execution vulnerability caused by improper neutralization of special elements used in an OS command. The issue affects the ACS component of IBM i Access Client Solutions and is categ...

CVE-2026-13433

IBM i Access Client Solutions 1.1.2.0–1.1.9.13 downloads unverified code from an IBM i source (CWE-494), allowing a bad actor to execute compromised code on the user's workstation. IBM CVSS scores this 8.3 (HIGH). Fix: upgrade to version 1.1.9.14 or later. No in-the-wild exploitation reported. No...

CVE-2026-14875

CVE-2026-14875 affects IBM i Access Client Solutions (ACS) on Windows, with versions 1.1.2.0 through 1.1.9.13 vulnerable when installed for all users due to a publicly writable directory. The underlying issue enables arbitrary code execution with local access and requires user interaction. IBM’s ...

CVE-2026-13094

IBM i Access Client Solutions (ACS) is affected by CVE-2026-13094. Vulnerable versions are ACS 1.1.2.0 through 1.1.9.13 on Windows when installed for all users, due to a publicly writable configuration file that enables arbitrary code execution. The IBM advisory lists a base CVSS v3.1 score of 7....

CVE-2026-14866

IBM i Access Client Solutions (ACS) versions 1.1.2.0–1.1.9.13 are affected by multiple vulnerabilities, including CVE-2026-14866, due to a publicly writable truststore that enables injection of rogue certificates. The cited advisory and CVE list indicate a local attack surface with high impact on...

CVE-2023-45182

The CVE-2023-45182 entry affects IBM i Access Client Solutions versions 1.1.2–1.1.4 and 1.1.4.3–1.1.9.3. The root issue is that the key used to encrypt passwords can be decoded if an attacker gains access to the encrypted password, enabling a local attacker to obtain passwords for other systems. ...

CVE-2023-45184

CVE-2023-45184 concerns IBM i Access Client Solutions. Affected versions: 1.1.2–1.1.4 and 1.1.4.3–1.1.9.3. Root cause: improper authority checks allow an attacker to obtain a decryption key. Red Hat and other sources confirm the issue and reference IBM X-Force ID 268270. Impact: potential exposur...