AI analysis
IBM i 7.3, 7.4, 7.5, and 7.6 have a critical code-injection flaw (CWE-94) in the HTTP Server Administration web application caused by improper data sanitization. A remote attacker who already has low-privileged credentials can send crafted input over the network, with no user interaction, and obtain sensitive information or execute arbitrary code; CVSS 3.1 rates this 9.9 with changed scope and high impact to confidentiality, integrity, and availability. Organizations running those IBM i releases with the HTTP administration interface reachable by authenticated users are affected. The issue is not in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known.
What to do: Apply the IBM security fix for CVE-2026-96119 on IBM i 7.3, 7.4, 7.5, and 7.6 as soon as IBM publishes it. Until then, keep the HTTP Server Administration web application off untrusted networks, limit it to trusted administrators, and review its access logs for unexpected authenticated activity.
Affected
| IBM i | 7.3, 7.4, 7.5, and 7.6 |
Estimated exposure
largeon the order of tens of thousands of IBM i systems — IBM i is a long-running enterprise operating system whose active install base is commonly described as on the order of tens of thousands of systems across currently supported releases; this is an order-of-magnitude estimate from public…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.