CVE-2026-96119

Summary

A remote authenticated attacker can exploit improper data sanitization in IBM i's HTTP Server Administration web application to gain sensitive information disclosure or execute arbitrary code on the system. This represents a critical vulnerability that could allow full system compromise.

Exploitability

Exploitation requires an authenticated user with access to the HTTP Server Administration web application, which is typically available to administrators and users with appropriate permissions, making it moderately difficult to exploit but not impossible.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary code on the IBM i system, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Detection

Monitor web server logs for suspicious HTTP requests to the administration endpoints with unusual parameters or payloads that could indicate exploitation attempts, particularly focusing on requests containing shell command injection patterns or unexpected data structures.

Prioritized remediation

Upgrade to IBM i 7.5 PTF SI75240 or later for systems running version 7.5, or IBM i 7.6 PTF SI76130 or later for systems running version 7.6.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.