IBM i Access Family versions 1.1.5.0 through 1.1.9.12 contain a vulnerability classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). This flaw allows remote code execution when the product is configured to accept requests from IBM i Navigator. The vulnerability is remotely exploitable with low attack complexity and requires low privileges but no user interaction. It impacts confidentiality, integrity, and availability, as reflected by the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No patch or official remediation level has been documented in the vendor advisory or CVE data.

Successful exploitation of this vulnerability could allow an attacker with network access and low privileges to execute arbitrary code remotely on the affected system. This could lead to full compromise of confidentiality, integrity, and availability of the system running IBM i Access Family. The vulnerability is rated high severity with a CVSS score of 8.8. There are currently no known active exploits in the wild.

Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting network access to IBM i Access Family services configured to listen for IBM i Navigator requests and monitor for unusual activity. Avoid exposing the vulnerable service to untrusted networks. Follow IBM's official guidance once available.