CVE-2026-14866 affects IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13. The vulnerability arises from a publicly writable truststore, which enables an attacker with local access to inject a rogue certificate authority. This flaw is categorized under CWE-798, indicating the use of hard-coded credentials that facilitate unauthorized truststore modifications. The CVSS 3.1 vector indicates local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality and integrity impact (C:H/I:H), with no impact on availability (A:N). No official patch or remediation level is currently documented.

An attacker with local access can exploit the publicly writable truststore to inject a rogue certificate authority, potentially enabling man-in-the-middle attacks or unauthorized access by compromising the trust model of the application. The confidentiality and integrity of the system are highly impacted, but availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for unauthorized modifications to the truststore. Avoid running the affected versions in untrusted environments.