High priorityDisclosed

Advisory · CVE-2026-93886

Script injection flaw in IBM i web administration

IBM i 7.3 through 7.6 does not properly validate user-supplied input, letting an authenticated attacker execute arbitrary script code. IBM rates it CVSS 3.1 8.3.

Advisory published October 13, 2026Independent summary
Vendor
IBM
Product
IBM i
Identifier / CWE
CVE-2026-93886
CWE-79
Action timing
Immediate
ELI5

Explain it like I’m five

A privileged user can plant script in the IBM i web interface that runs in someone else's browser when they open the page.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Privileged sign-in

    An attacker with high privileges and a victim's interaction reaches the affected web function.

  2. 02Unvalidated input

    The attacker stores input that IBM i does not properly validate.

  3. 03Script runs

    The stored script executes in the context of a user who views the affected page.

What happened

IBM disclosed CVE-2026-93886 for IBM i releases 7.3, 7.4, 7.5, and 7.6. Improper validation of user-supplied input (CWE-79) lets an authenticated remote attacker execute arbitrary script code; IBM’s vector requires high privileges and user interaction and scores it 8.3 with changed scope.

No fixed version is named in the NVD record, so remediation follows the IBM bulletin and its PTF guidance rather than a version guess here.

What to do

  1. Inventory every IBM i deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to IBM i while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for stored content changes in IBM i web administration pages and reports of odd admin-console behavior.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

The privilege requirement limits this one, but script running in an administrator’s browser on an IBM i estate is still worth the PTF. Apply the bulletin fix.