CVE-2026-14875 describes an untrusted search path vulnerability in IBM i Access Client Solutions on Windows platforms. When installed for all users, the application creates or uses a directory that is publicly writable, allowing an attacker with local access and limited privileges to place malicious executables or code in that directory. This can lead to arbitrary code execution with the privileges of the application. The vulnerability affects versions 1.1.2.0 through 1.1.9.13. No official patch or remediation level has been published as of the provided data.

An attacker with local access and limited privileges can exploit the publicly writable directory to execute arbitrary code with the privileges of IBM i Access Client Solutions. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write permissions on the installation directories to trusted users only and avoid installing the software for all users if possible. Monitor for updates from IBM regarding patches or official mitigations.