{"id":"CVE-2026-96119","published":"2026-10-13T00:17:02.053","lastModified":"2026-10-14T23:48:20.053","description":"IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":["ibm"],"products":["i"],"references":[{"url":"https://www.ibm.com/support/pages/node/7292159","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A remote authenticated attacker can exploit improper data sanitization in IBM i's HTTP Server Administration web application to gain sensitive information disclosure or execute arbitrary code on the system. This represents a critical vulnerability that could allow full system compromise.","exploitability":"Exploitation requires an authenticated user with access to the HTTP Server Administration web application, which is typically available to administrators and users with appropriate permissions, making it moderately difficult to exploit but not impossible.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the IBM i system, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.","remediation":"Upgrade to IBM i 7.5 PTF SI75240 or later for systems running version 7.5, or IBM i 7.6 PTF SI76130 or later for systems running version 7.6.","detection":"Monitor web server logs for suspicious HTTP requests to the administration endpoints with unusual parameters or payloads that could indicate exploitation attempts, particularly focusing on requests containing shell command injection patterns or unexpected data structures.","tags":["web","rce","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:46:49.353Z"}}