CVE-2026-93886: IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.
Other sources
IBM i could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch SJ11645 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch SJ11644 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch SJ11643 - Upgrade
Upgrade
IBM ito a version that resolves this vulnerability.Patch SJ11641
Event History
Frequently Asked Questions
Which IBM i releases are affected?
The affected releases listed are IBM i 7.3, 7.4, 7.5, and 7.6.
What does an attacker need to exploit this issue?
Exploitation requires remote authenticated access. The CVSS vector also indicates user interaction is required.
What is the potential impact if exploitation succeeds?
The vulnerability can allow arbitrary script execution. The CVSS assessment indicates high confidentiality and integrity impact, low availability impact, and a scope change.