CVE-2026-14875 is a high severity flaw (CVSS 7.3) in IBM i Access Client Solutions on Windows. When installed for all users, a publicly writable directory allows arbitrary code execution. IBM's fix is ACS 1.1.9.14 or later, or the PTF for your IBM i release.
What's affected
- IBM i Access Client Solutions (ACS) 1.1.2.0 through 1.1.9.13.
- Fixed: ACS 1.1.9.14 or later. IBM also lists PTFs by IBM i release: SJ11046 for 7.6, SJ11044 for 7.5, SJ11045 for 7.4 and SJ11043 for 7.3.
- Workarounds: none listed.
Severity: the record and IBM agree on 7.3 High (vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). The scenario is Windows, all users installs.
How to check if you're exposed
Find Windows machines where ACS was installed for all users, not for a single user. The affected versions are 1.1.2.0 through 1.1.9.13.
Check the installation directory's permissions. If standard users can write into it, the exposure matches the bulletin. Your endpoint management tool can usually report the install location and version for each machine.
Shared systems such as remote desktop hosts are the highest priority, because an attacker's file can be run by another user who launches the client.
What to do now
- List Windows hosts with an all-users ACS installation.
- Upgrade to ACS 1.1.9.14 or later, or apply the PTF for your IBM i release.
- After the upgrade, check the install directory's permissions.
- Where you cannot upgrade soon, consider a per-user install, but check IBM's guidance first since the bulletin lists no workaround.
Why it matters
The record maps this to CWE-426 (Untrusted Search Path). Programs that load code from a location that unprivileged users can write to may run attacker planted files. In an all-users install, a directory that anyone can write to and that a more privileged user later runs from is a classic route to code execution in someone else's context.
The vector shows user interaction is required, because a user must launch the client, and a low privilege local account is needed. Those conditions keep it at High rather than Critical. The record does not list the CVE as exploited, and it is not in the CISA KEV catalog.
File permission flaws like this one are often fixed by installers, but older installations keep their old permissions. After upgrading, verify the directory's access control list on a sample of machines instead of assuming the installer repaired it everywhere.
Quick check
Does a per-user install avoid this?
The bulletin lists no workaround and describes the all-users case. Confirm with IBM.
Does it need user interaction?
Yes. The vector marks user interaction as required.
Sources
Last reviewed: 18 October 2026.
