Patch Forecast
Amber warning
Patch this week.

CVE-2026-96119

Ibm I: code injection can lead to remote code execution

Risk score
68/100
CVSS
9.9 v3.1
Exploit chance (30 days)
0.5%
Published
13 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
Affected
Ibm I
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Ibm ITHE FLAWSTHE FIXCVE-2026-96119Code injection can lead toremote code executionCVSS 9.9 · EPSS 1%CVE-2026-81858Out-of-bounds read can lead todenial of serviceCVSS 8.1 · EPSS 0%CVE-2026-84414IBM i 7.6, 7.5, 7.4, and 7.3could allow a localauthenticated attacker to…CVSS 7.8 · EPSS 0%CVE-2026-102917Privilege escalationCVSS 7.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedIbm IAMBER · PATCH THIS WEEKIbm IIBM i 7.3, 7.4, 7.5, and 7.6 couldallow a remote authenticatedattacker to obtain sensitiveinformation or executearbitrary code on the systemdue to improper datasanitization by the HTTP…Where it standsNo known exploitationCONNECTS TOSame weaknessCode injection (CWE-94)239 other warnings in 30 days →Same productEarlier Ibm I warnings11 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Ibm I: Amber, patch this week. IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

The flaws

  • CVE-2026-96119: Code injection can lead to remote code execution (CVSS 9.9 · EPSS 1%)
  • CVE-2026-81858: Out-of-bounds read can lead to denial of service (CVSS 8.1 · EPSS 0%)
  • CVE-2026-84414: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of… (CVSS 7.8 · EPSS 0%)
  • CVE-2026-102917: Privilege escalation (CVSS 7.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Ibm I

Where it stands

  • No known exploitation

Connects to

Why it is Amber

  • CVSS 9.9 critical

References

Original description

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

Last activity 13 Oct 2026. Patch Forecast updates every hour.