CVE-2026-13433 affects IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.13. The vulnerability arises because ACS can download product code updates from an IBM i system without verifying the integrity of the downloaded code. This lack of integrity check (CWE-494) allows a remote attacker with access to the update source to supply malicious code that ACS will execute on the user's workstation. The vulnerability has a CVSS 3.1 score of 8.3, indicating a high-severity remote code execution risk with complete impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available, and no known exploits are reported in the wild.

An attacker able to control the update source can deliver malicious code to ACS users, leading to remote code execution on the affected workstation. This compromises the confidentiality, integrity, and availability of the user's system. The vulnerability requires network access with high attack complexity and no privileges or user interaction, but the impact is severe if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling automatic updates from IBM i systems or restrict update sources to trusted environments to reduce exposure.