Act nowDisclosed

Advisory · CVE-2026-96119

IBM i HTTP Server Administration flaw can give code execution

IBM i 7.3 through 7.6 has an improper data sanitization flaw in the HTTP Server Administration web application that can let an authenticated attacker read sensitive information or execute arbitrary code. IBM rates it CVSS 3.1 9.9.

Advisory published October 13, 2026Independent summary
Vendor
IBM
Product
IBM i
Identifier / CWE
CVE-2026-96119
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

The web admin console for IBM i does not clean up attacker input properly, so a signed-in user can turn that input into code on a very trusted machine.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Sign in

    An attacker with a valid IBM i account opens the HTTP Server Administration web application.

  2. 02Unsanitized input

    The attacker submits data the application fails to sanitize.

  3. 03Code or disclosure

    The flaw lets the attacker execute arbitrary code or obtain sensitive information on the system.

What happened

IBM disclosed CVE-2026-96119 for IBM i releases 7.3, 7.4, 7.5, and 7.6. The HTTP Server Administration web application improperly sanitizes data (CWE-94), and an authenticated remote attacker can use it to obtain sensitive information or execute arbitrary code. IBM scores it 9.9 with changed scope.

No fixed version is named in the NVD record, so remediation follows the IBM bulletin and its PTF guidance rather than a version guess here.

What to do

  1. Inventory every IBM i deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to IBM i while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for unusual activity in the HTTP Server Administration application, new objects or user profiles, and unexpected jobs after admin-console use.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

IBM i systems usually run the workloads a business can least afford to lose. A 9.9 in the admin web app deserves PTF urgency and a log review.