CVE-2026-14875 is an untrusted search path vulnerability (CWE-426) in IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 on Windows. When the software is installed for all users, it creates a publicly writable directory that can be exploited by a local attacker to execute arbitrary code. This occurs because the application may load executables or libraries from a directory that can be modified by unauthorized users, leading to privilege escalation or code execution within the context of the user running the application.

Successful exploitation of this vulnerability could allow a local attacker with limited privileges to execute arbitrary code with the privileges of the user running IBM i Access Client Solutions. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid installing IBM i Access Client Solutions for all users on Windows systems or restrict permissions on the installation directories to prevent unauthorized write access.