CVE-2026-96119: IBM i HTTP Server Administration GUI Code Injection Vulnerability
IBM i versions 7.3 through 7.6 are affected by a code injection flaw (CWE-94) in the HTTP Server Administration web application, caused by improper data sanitization. The record describes a remote authenticated attacker who could obtain sensitive information or execute arbitrary code, with a CVSS 3.1 base score of 9.9 reported by IBM. The record lists no fixed versions, so the IBM advisory should be reviewed for remediation.
Overview
CVE-2026-96119 affects the HTTP Server Administration graphical interface of IBM i. According to the record, the web application does not properly sanitize data, which is classified as code injection (CWE-94). IBM acts as the CNA for this record, and its status in NVD is still awaiting analysis.
Impact
- Confidentiality: the record indicates that an attacker could obtain sensitive information.
- Code execution: the record indicates that an attacker could execute arbitrary code on the system.
- IBM's CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, with a base score of 9.9 (critical). The vector marks the scope as changed and rates confidentiality, integrity and availability impact as high.
Affected products and versions
- IBM i 7.3
- IBM i 7.4
- IBM i 7.5
- IBM i 7.6
The record lists these versions as affected and contains no fixed versions or PTF identifiers. The vendor advisory is available at IBM support node 7292159.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted. The SSVC data in the record rates exploitation as none and automatable as no. The EPSS probability is 0.00508 with a percentile of 0.4174, dated 2026-10-13.
Remediation and mitigation
- Review the IBM advisory and apply the fix IBM provides for your IBM i release, since the record does not list one.
- Until the fix is applied, limit authenticated access to the HTTP Server administration interface to the minimum set of accounts, following least privilege.
- Restrict network access to the administration interface to trusted administrative networks.
- After patching, verify that the HTTP Server configuration matches approved baselines.
Detection guidance
- Review access logs of the HTTP Server administration application for unexpected requests or unusual activity from authenticated accounts.
- Watch for authentication anomalies, newly created or modified administrative accounts, and unexpected changes to server configuration.
- Correlate these events with network telemetry to identify administrative access from unexpected sources.
Limitations of the available information
The record does not describe the exact input vector, the detailed exploitation conditions beyond the authentication requirement, or any fixed version. The NVD status is awaiting analysis. Treat the patch status as unknown until the vendor advisory has been reviewed.
Frequently asked questions
Which IBM i versions are affected?
The record lists IBM i 7.3, 7.4, 7.5 and 7.6 as affected by this HTTP Server Administration GUI vulnerability.
Is a fix available?
The record does not list any fixed versions. Review the IBM support advisory at node 7292159 for remediation details for your release.
Is this vulnerability known to be exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.