IBM i 7.3 through 7.6 share a CVSS 9.9 code-injection flaw in the HTTP admin app
IBM disclosed CVE-2026-96119 on October 13, 2026, a CVSS 9.9 code-injection flaw in the HTTP Server Administration app on IBM i 7.3, 7.4, 7.5 and 7.6. Exploitation needs a valid login to that app, so limiting who can reach it works before the patch lands.
The Engineer · Build desk
Attackers need valid credentials and access to the admin app, with no victim interaction. IBM i shops often have shared accounts and weak passwords. Patching runs through long maintenance windows. Shops on 7.3 face upgrade planning. Code execution can reach customer data.
- constraint Attackers with a valid login Need valid credentials and access to the HTTP Server Administration app; no victim interaction, claim 4
- exposure IBM i shops Often have shared service accounts and weak passwords on non-production profiles also in production, claim 11
- constraint IBM i patch process Long maintenance windows, change-control boards and quarterly IPLs; the post advises starting now, claim 8
- decision Shops still on IBM i 7.3 The post calls 7.3 older and says this CVE argues for accelerating upgrade planning, claim 9
- exposure Customer accounts and data Code execution in a privileged server job can be a direct path to the database libraries holding them, claim 12
| Who | How | Kind | Claim |
|---|---|---|---|
| Attackers with a valid login | Need valid credentials and access to the HTTP Server Administration app; no victim interaction | constraint | 4 |
| IBM i shops | Often have shared service accounts and weak passwords on non-production profiles also in production | exposure | 11 |
| IBM i patch process | Long maintenance windows, change-control boards and quarterly IPLs; the post advises starting now | constraint | 8 |
| Shops still on IBM i 7.3 | The post calls 7.3 older and says this CVE argues for accelerating upgrade planning | decision | 9 |
| Customer accounts and data | Code execution in a privileged server job can be a direct path to the database libraries holding them | exposure | 12 |
What happened
- The weakness is CWE-94: the app fails to sanitize data it processes, and the stated impact is information disclosure or arbitrary code execution.
- The CVSS 3.1 vector is network, low complexity, low privileges and no user interaction, with high impact on confidentiality, integrity and availability.
- The attacker needs a valid login on the system with access to the admin app, and no victim has to do anything.
- No confirmed public proof of concept existed at disclosure, according to the post.
- The fix is a PTF for each release, with the numbers listed in IBM's PSIRT advisory.
Why it matters
- exposure Exposure depends on how many profiles can reach the app, and the post says IBM i shops often carry shared service accounts and weak passwords on non-production profiles that also exist in production.
- constraint The post describes long maintenance windows, change-control boards and quarterly IPLs as typical, so the PTF will queue behind a change process and the gap needs a control of its own.
- contradiction The post calls the flaw especially dangerous because IBM i is rarely patched first, yet it also reports low EPSS modeling and no public exploit, so the danger rests on its warning about targeted attackers.
- decision Shops still on IBM i 7.3 face an upgrade-planning question as well as a PTF, since the post calls it an older release.
How far an attacker gets depends on the platform. According to the dev.to post, a single IBM i partition may host the database, the application logic and the web tier [7]. Objects carry authority with them, and a job with enough authority can reach across what would be hard boundaries on other platforms [10]. The post concludes that code execution in a privileged server job can lead straight to the database libraries where customers' personal data, accounts and balances are stored [12].
The post does not identify the vulnerable input or say what authority the admin server job runs under. Both decide how bad a given install is, and both belong in the check against IBM's advisory, which the post calls the authoritative source for the fix [13].
In our view, access is the quicker control. The precondition is a valid login with access to the admin app [4], so cutting the profiles and network paths that reach that interface lowers exposure now, while the PTF waits on a change board [8]. That order suits a shop on the cadence the post describes. It costs more if the team administers the web server through that interface every day, and that cost is worth measuring before anyone closes the door.
A low EPSS estimate [15] and no confirmed public proof of concept [14] support patching in the next change window. Until then, the admin interface should not be reachable by profiles with no reason to use it.
What to watch
- A public proof of concept for CVE-2026-96119, which the post says did not exist at disclosure.
- Any revision to the low EPSS estimate the post cites for near-term exploitation.
- The PTF numbers in IBM's PSIRT advisory for each release and technology refresh level, which the post does not list.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On October 13, 2026, IBM disclosed CVE-2026-96119, a critical code-injection vulnerability in the HTTP Server Administration web application on IBM i versions 7.3, 7.4, 7.5 and 7.6.
- [2]
The flaw is classified CWE-94 (code injection): the application fails to properly sanitize data it processes, and an attacker can obtain sensitive information or execute arbitrary code on the system.
- [3]
The CVSS 3.1 score is 9.9 (Critical): network attack vector, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
- [4]
The attacker must be remote and authenticated, with valid credentials on the system and access to the HTTP Server Administration application; no victim interaction is needed.
- [5]
IBM's PSIRT advisory provides the PTF numbers for each release; the fix is to apply the PTF for your exact release and technology refresh level.
- [6]
IBM i systems run core banking, insurance, manufacturing and retail workloads, often for decades, and are rarely the first systems in the patch queue, which the post says makes a 9.9 on this platform especially dangerous.
- [7]
On IBM i, a single partition may host the database, the application logic and the web tier.
- [8]
IBM i environments are typically managed with long maintenance windows, change-control boards and quarterly IPLs; the post advises starting the patch process now rather than waiting for the next scheduled window.
- [9]
IBM i 7.3 is an older release, and the post says that if you are still running it this CVE is another argument for accelerating upgrade planning.
- [10]
Objects on IBM i carry authority with them, and a job running with sufficient authority can reach across what would be hard boundaries on other platforms.
- [11]
IBM i shops often have many user profiles, shared service accounts and default or weak passwords on non-production profiles that also exist in production.
- [12]
Arbitrary code execution in a privileged server job on IBM i can be a direct path to the database libraries holding customer accounts, balances and personal data.
- [13]
IBM's disclosure is the authoritative source for the fix.
- [14]
No confirmed public proof-of-concept existed at disclosure.
- [15]
Independent EPSS modeling, as cited by the post, places near-term exploitation probability low.
- [16]
The post adds that IBM i flaws attract targeted, quiet exploitation against high-value tenants.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toCVE-2026-96119: IBM i HTTP Server Administration Code Injection Vulnerability — Analysis & Mitigation
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Code injectionFollow
- Enterprise systems securityFollow
- Vulnerability ManagementFollow