IBM i HTTP Server Admin Flaw Rated Critical, Allows Remote Code Execution

A critical security vulnerability has been identified in multiple versions of the IBM i operating system, specifically affecting its HTTP Server Administration web application. The flaw, tracked as CVE-2026-96119, allows remote authenticated attackers to execute arbitrary code or obtain sensitive information on affected systems due to improper data sanitization.

The vulnerability is rated 9.9 on the Common Vulnerability Scoring System, placing it in the critical severity category. This high score reflects the significant risk posed by the ability to execute arbitrary code. The underlying weakness is categorized as CWE-94, which relates to improper control of generation of code. This type of defect often arises when an application includes code from external inputs without sufficient validation or sanitization, allowing attackers to inject malicious commands that the system then processes as legitimate instructions.

Context and Background

The issue resides within the HTTP Server Administration web application component of the IBM i platform. According to the National Vulnerability Database record, the root cause is improper data sanitization. This means the application fails to adequately filter or validate input data before processing it. When an authenticated user submits maliciously crafted data to this web interface, the system may interpret parts of that input as executable code rather than simple data. This confusion between data and code execution is a classic vector for severe security breaches, potentially granting attackers full control over the compromised system.

The severity rating of 9.9 indicates the critical nature of the vulnerability. However, the attacker must first possess valid authentication credentials to access the administration interface. This requirement limits the immediate attack surface to those who have already breached perimeter defenses or have legitimate access to the system, but it does not mitigate the critical nature of the potential outcome once access is gained.

Who Is Affected

The vulnerability impacts four specific versions of the IBM i operating system. According to the advisory, IBM i 7.3, 7.4, 7.5, and 7.6 are all susceptible to this exploit. Organizations running any of these versions should verify their exposure immediately. The wide range of affected versions suggests that the flaw exists in a core component shared across these releases, rather than being isolated to a single recent update. System administrators managing IBM i environments must audit their current version status to determine if their infrastructure falls within this affected range.

The source material does not state whether a patch or fix is available. Security teams should monitor official channels for the release of a remediation package. In the interim, restricting access to the HTTP Server Administration web application to trusted networks and enforcing strict authentication policies may help reduce the risk of unauthorized exploitation.

What should you do?

Security professionals should prioritize identifying all instances of IBM i versions 7.3 through 7.6 within their networks. Once identified, teams should assess the exposure level of the HTTP Server Administration web application. If the application is accessible from untrusted networks, immediate network segmentation or access control list updates are advisable. Organizations should also review authentication logs for any unusual activity that might indicate an attacker is attempting to leverage existing credentials to probe for this vulnerability.