CVE-2026-13433 is a high severity flaw (CVSS 8.3) in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13. When it is set to update from an IBM i, it downloads product code without verifying it. The fix is version 1.1.9.14 or later, or the PTF for your IBM i release.
What's affected
IBM lists IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 as affected. The condition is that the client is configured to update from an IBM i.
The fix is 1.1.9.14 or later. IBM says you can get it from the downloads page, from Entitled Systems Support, or by applying a PTF to IBM i. The PTFs on the bulletin are SJ11046 for 7.6, SJ11044 for 7.5, SJ11045 for 7.4 and SJ11043 for 7.3. IBM lists no workaround.
How to check if you're exposed
In Access Client Solutions, open Help and About to read the version. If it is between 1.1.2.0 and 1.1.9.13, it is in range. Then check whether the client is set to pull updates from an IBM i system, which is the condition in the advisory.
On the IBM i side, check whether the PTF for your release is applied. Per the bulletin, applying it provides the fixed client for distribution.
If you manage many workstations, query the installed version from your software inventory. ACS is a Java based client, so the version may also appear in its folder name or the application properties. Compare it with the 1.1.9.14 fixed level.
IBM says there are three ways to get the current version: the downloads page, Entitled Systems Support, or a PTF to IBM i. Note which one your team uses, so future updates come from one known source.
What to do now
- Find workstations running ACS and note versions.
- Upgrade to 1.1.9.14 or later from IBM downloads or ESS.
- Apply the PTF for your IBM i release (SJ11046, SJ11044, SJ11045 or SJ11043).
- Until you do, avoid automatic updates from an IBM i you cannot vouch for.
- Confirm who can write to the update location on the IBM i.
- Check the integrity of the update source on the IBM i, and who has write access to it.
Why it matters
The weakness is download of code without an integrity check. If a client fetches an update and runs it with no signature or hash check, anyone who can alter the update in transit or at rest can run code on the workstation. The scope changed in the vector, because code on a workstation reaches beyond the client itself.
The vector shows an adjacent network attacker with high complexity, so exposure is mostly local to your network. The record does not flag this CVE as known exploited.
Integrity checks on downloaded code are basic. A client that updates itself is trusted by the machine to run new code, so the update channel needs a signature or hash that the client verifies. IBM does not describe its change in detail, so we stay with the record.
The record lists this weakness class: CWE-494 (Download of Code Without Integrity Check).
Quick check
Do I have to be updating from IBM i to be exposed?
IBM says the issue applies when the client is configured to update from an IBM i. The advisory gives no workaround, so upgrade the client.
Is there a workaround?
IBM lists none. Upgrading to 1.1.9.14 or later is the fix.
Sources
Last reviewed: 19 October 2026.
