CVE-2026-49483: Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution

Q: Who is exposed to this issue?

Installations of Code for IBMi before 3.0.1 are exposed when IBMi components have broad public permissions that let a different local IBM i account modify them. A user who later connects through the extension may then execute the modified component under that connecting account.

Q: What does an attacker need to exploit it?

The attacker needs local access to the IBM i environment through an account able to alter an affected publicly writable IBMi component, such as GETMBRINFO. Exploitation also requires a later connection by another user that causes the altered component to run.

Q: Are default installations affected?

The issue depends on component permissions being broad enough for another local account to modify them. The provided information does not establish whether those permissions are present by default.

Q: What should be done if updating cannot happen immediately?

Restrict public permissions on IBMi components so other local accounts cannot alter them, and review components such as GETMBRINFO for unauthorized changes. Update Code for IBMi to version 3.0.1 when possible.

Published Oct 12, 2026

Updated

Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONGCOMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.

Affected Software

1 affected component

IBM Code for IBMi<3.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Code for IBMi to a version that resolves this vulnerability.
Fixed in 3.0.1

Event History

Oct 12, 2026

CVE Published

via MITRE·09:36 PM

Data Sourced

via MITRE·09:36 PM

DescriptionWeakness

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Installations of Code for IBMi before 3.0.1 are exposed when IBMi components have broad public permissions that let a different local IBM i account modify them. A user who later connects through the extension may then execute the modified component under that connecting account.

What does an attacker need to exploit it?

The attacker needs local access to the IBM i environment through an account able to alter an affected publicly writable IBMi component, such as GETMBRINFO. Exploitation also requires a later connection by another user that causes the altered component to run.

Are default installations affected?

The issue depends on component permissions being broad enough for another local account to modify them. The provided information does not establish whether those permissions are present by default.

What should be done if updating cannot happen immediately?

Restrict public permissions on IBMi components so other local accounts cannot alter them, and review components such as GETMBRINFO for unauthorized changes. Update Code for IBMi to version 3.0.1 when possible.

CVE-2026-49483: Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default installations affected?

What should be done if updating cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default installations affected?

What should be done if updating cannot happen immediately?