CVE-2026-14866 is a high severity flaw (CVSS 7.7) in IBM i Access Client Solutions. The truststore is publicly writable, so a local user can inject a rogue certificate authority. IBM's fix is ACS 1.1.9.14 or later, or the PTF for your IBM i release.
What's affected
- IBM i Access Client Solutions (ACS) 1.1.2.0 through 1.1.9.13.
- Fixed: ACS 1.1.9.14 or later. IBM also lists PTFs by IBM i release: SJ11046 for 7.6, SJ11044 for 7.5, SJ11045 for 7.4 and SJ11043 for 7.3.
- Workarounds: none listed.
Severity: the record and IBM agree on 7.7 High (vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
How to check if you're exposed
Check the ACS version in the product's About dialog, or the version in the install directory on your workstations and jump hosts. Anything from 1.1.2.0 to 1.1.9.13 is in range.
Also check the truststore's permissions on a workstation that has ACS. If ordinary users can modify the file, that matches the weakness the bulletin describes. On Windows, review the folder's access control list with your standard tooling, and on Unix style systems use a long directory listing.
Shared hosts, terminal servers and jump boxes deserve the first look, since several users share one installation.
What to do now
- Inventory ACS installations, with extra attention to shared and multi-user machines.
- Upgrade to ACS 1.1.9.14 or later using IBM's ACS updates page.
- Where ACS is not installed on the client, apply the PTF for your IBM i release from the list above.
- After upgrading, check that the truststore is no longer writable by ordinary users.
- Review the truststore on affected machines for certificate authorities nobody recognises.
Why it matters
The record lists CWE-798 (Use of Hard-coded Credentials), which is an imperfect label for a file permission problem. IBM's description is more direct: a publicly writable truststore. Any local user can add a certificate authority that the client then trusts.
A trusted rogue CA lets an attacker present a certificate for a server and have the client accept it, which opens the door to interception of connections to IBM i systems. The attack needs local access, but shared machines are common in operations teams. The record does not list the CVE as exploited, and it is not in the CISA KEV catalog.
A quick audit helps even after patching. List the certificate authorities in the ACS truststore on a few representative machines and compare them with a clean install. Anything extra deserves an explanation, since the flaw lets any local user add one without leaving an obvious trace.
Quick check
Does the attacker need to be on the same machine?
Yes. The vector is local with no privileges required.
Is there a workaround?
IBM lists none. Upgrade or apply the PTF.
Sources
Last reviewed: 18 October 2026.
