IBM i Access Family versions 1.1.5.0 through 1.1.9.12 contain a vulnerability classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). This flaw allows remote code execution when the IBM i Access Client Solutions component is configured to listen for requests from IBM i Navigator. The vulnerability is network exploitable with low attack complexity and requires low privileges but no user interaction. It impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on affected systems, potentially leading to full compromise of the IBM i Access Client Solutions environment. This impacts the confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider limiting network exposure of IBM i Access Client Solutions configured to listen for IBM i Navigator requests and monitor for unusual activity related to this component. Follow IBM's official communications for updates on patches or mitigations.