CVE-2026-96119: IBM i HTTP Server Administration Code Injection Vulnerability — Analysis & Mitigation
Summary On October 13, 2026, IBM disclosed CVE-2026-96119 , a critical code-injection vulnerability in the HTTP Server Administration web application on IBM i versions 7.3, 7.4, 7.5, and 7.6 . A remote authenticated attacker can exploit improper data sanitization to obtain sensitive information or execute arbitrary code on the system. The flaw carries a CVSS score of 9.9 out of 10 . For the…
On October 13, 2026, IBM issued a critical security advisory disclosing CVE-2026-96119, a code-injection vulnerability affecting IBM i versions 7.3, 7.4, 7.5, and 7.6. This flaw, classified as CWE-94, allows a remote authenticated attacker to inject malicious code which the system then executes, resulting in potential information disclosure or arbitrary code execution.
With a CVSS score of 9.9, the impact is deemed critical, as a successful exploit could compromise the integrity, confidentiality, and availability of the entire business workload hosted on the vulnerable IBM i system. Despite no public proof-of-concept being confirmed, IBM asserts that the vulnerability represents a significant risk, particularly given the platform's widespread use in running core systems for industries such as banking, insurance, manufacturing, and retail.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
