CVE-2026-96119: IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI
Published Oct 12, 2026
·Updated
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
Affected Software
1 affected component
IBM IBM i=7.3, =7.4, =7.5, =7.6
Event History
Oct 12, 2026
CVE Published
via MITRE·11:22 PM
Data Sourced
via MITRE·11:22 PM
RemedyDescriptionSeverityWeakness
Oct 13, 2026
Data Sourced
via NVD·12:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker must be authenticated to the HTTP Server Administration web application. No user interaction is required, and the attack can be performed over the network.
2
Which IBM i releases are affected?
IBM i 7.3, 7.4, 7.5, and 7.6 are identified as affected.
3
What could a successful attacker do?
An authenticated attacker could obtain sensitive information or execute arbitrary code on the affected system. The stated impact includes confidentiality, integrity, and availability consequences.