CVE-2026-96119: IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM i HTTP Server Administrationto a version that resolves this vulnerability.Fixed in 7.6Patch SJ11645 - Upgrade
Upgrade
IBM i HTTP Server Administrationto a version that resolves this vulnerability.Fixed in 7.5Patch SJ11644 - Upgrade
Upgrade
IBM i HTTP Server Administrationto a version that resolves this vulnerability.Fixed in 7.4Patch SJ11643 - Upgrade
Upgrade
IBM i HTTP Server Administrationto a version that resolves this vulnerability.Fixed in 7.3Patch SJ11641
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must be authenticated to the HTTP Server Administration web application. No user interaction is required, and the attack can be performed over the network.
Which IBM i releases are affected?
IBM i 7.3, 7.4, 7.5, and 7.6 are identified as affected.
What could a successful attacker do?
An authenticated attacker could obtain sensitive information or execute arbitrary code on the affected system. The stated impact includes confidentiality, integrity, and availability consequences.