How does CVE-2026-96119 enable arbitrary code execution on IBM i HTTP Server?
A critical vulnerability in IBM i HTTP Server Administration allows authenticated attackers to run arbitrary code on affected systems.
Key points
- CVE-2026-96119 carries a CVSS score of 9.9, classified as critical severity by the National Vulnerability Database.
- The flaw stems from improper data sanitization within the HTTP Server Administration web application interface.
- IBM i versions 7.3, 7.4, 7.5, and 7.6 are confirmed to be affected by this remote code execution risk.
The National Vulnerability Database has assigned CVE-2026-96119 to a severe security flaw in IBM i HTTP Server Administration. This vulnerability allows a remote attacker who has already authenticated to the system to execute arbitrary code. The issue arises because the web application fails to properly sanitize incoming data, creating a pathway for malicious input to bypass normal safety checks.
Root cause
The underlying technical weakness is identified as CWE-94, which relates to improper neutralization of user input. In this specific case, the HTTP Server Administration component does not adequately filter or validate data before processing it. This lack of sanitization means that an attacker can inject harmful commands into the application’s workflow. The system then treats these injected commands as legitimate instructions, leading to unintended execution.
Attack path
An attacker must first obtain valid authentication credentials for the IBM i system to exploit this vulnerability. Once logged in, they can target the HTTP Server Administration web interface. By submitting specially crafted data that exploits the sanitization failure, the attacker can trigger arbitrary code execution. This action grants the attacker the ability to run their own code on the host system, potentially leading to full control over the affected environment.
Affected versions
The vulnerability impacts multiple recent releases of the IBM i operating system. According to the NVD record, the following versions are susceptible to CVE-2026-96119:
- IBM i 7.6
- IBM i 7.5
- IBM i 7.4
- IBM i 7.3
Mitigation
The source material does not confirm the availability of a patch or fix. Administrators should treat this vulnerability as a significant risk due to its critical rating. The primary defense is to strictly limit access to the HTTP Server Administration interface. Only essential personnel should have authenticated access to this web application. Reducing the number of users with administrative privileges decreases the likelihood of credential compromise.
What to do and how to stay safe: IBM
- Review access logs for the HTTP Server Administration interface to identify any unusual authentication attempts or activity from unexpected sources.
- Enforce strict password policies and multi-factor authentication for all accounts that have access to IBM i administrative functions.
- Isolate systems running affected IBM i versions from untrusted networks to limit remote exposure while monitoring for vendor updates.
- Monitor official IBM security advisories for the release of a fix for CVE-2026-96119 and apply it as soon as it becomes available.
Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures
General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity rating of CVE-2026-96119?
The National Vulnerability Database rates this vulnerability as Critical with a CVSS score of 9.9.
Which IBM i versions are affected by this flaw?
IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by CVE-2026-96119.
Can an unauthenticated attacker exploit this vulnerability?
No, the source material states that a remote authenticated attacker is required to exploit this flaw.
