CVE-2026-13094 is a vulnerability in IBM i Access Client Solutions affecting versions 1.1.2.0 through 1.1.9.13 on Windows. The issue arises because the configuration file is publicly writable when the software is installed for all users, enabling an attacker with low privileges to perform arbitrary code execution. This is classified under CWE-94 (Improper Control of Generation of Code). The CVSS 3.1 base score is 7.8, indicating high severity with attack vector local, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with local low privileges can exploit the publicly writable configuration file to execute arbitrary code on the affected system. This can lead to full compromise of the system's confidentiality, integrity, and availability. The vulnerability does not require user interaction but does require local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write permissions on the configuration file to trusted users only and avoid installing IBM i Access Client Solutions for all users on Windows systems.