Key points
- CVE-2026-96119 is rated 9.9 Critical on the CVSS scale by the National Vulnerability Database.
- The flaw stems from improper data sanitization within the HTTP Server Administration interface.
- Affected systems include IBM i releases 7.3, 7.4, 7.5, and 7.6.
Software developers managing IBM i environments must immediately assess their exposure to CVE-2026-96119, a critical security flaw that enables remote code execution. The National Vulnerability Database lists the vulnerability with a CVSS score of 9.9, indicating severe risk. Attackers who have obtained valid authentication credentials can exploit this defect to take control of the server or steal sensitive information.
The vulnerability resides specifically within the HTTP Server Administration web application. According to the NVD record, the root cause is improper data sanitization. This weakness allows malicious input to bypass security checks, leading to arbitrary code execution on the host system. The issue affects multiple versions of the IBM i operating system, requiring a broad audit of affected deployments.
What we know
The National Vulnerability Database entry for CVE-2026-96119 identifies the affected software as IBM i versions 7.3, 7.4, 7.5, and 7.6. The weakness is classified under CWE-94, which relates to code injection vulnerabilities. The description states that a remote authenticated attacker can leverage this flaw to execute arbitrary code or obtain sensitive data.
The HTTP Server Administration component is the specific vector for this attack. Improper data sanitization means that user-supplied input is not correctly filtered or escaped before being processed by the application. This allows an attacker to inject and execute malicious commands. The vulnerability is rated Critical by the NVD.
No patch or fix has been confirmed yet in the available source material. Organizations running the listed IBM i versions should assume they are vulnerable until an official update is released and verified. The risk is limited to remote attackers who possess valid authentication credentials, but the consequences of exploitation are severe.
Defender's checklist
- Verify if your IBM i instances are running versions 7.3, 7.4, 7.5, or 7.6.
- Review access logs for the HTTP Server Administration web application for suspicious activity.
- Ensure that only authorized personnel have authentication credentials for the administration interface.
- Monitor for any unusual code execution or data exfiltration attempts on affected systems.
What to do and how to stay safe: IBM i
- Restrict access to the HTTP Server Administration web application to trusted IP addresses only.
- Enforce multi-factor authentication for all accounts with administrative privileges on IBM i systems.
- Implement strict input validation rules at the network perimeter for traffic destined to the administration interface.
- Once the vendor provides an update, apply the patch immediately and verify the remediation through security testing.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which IBM i versions are affected by CVE-2026-96119?
IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by this vulnerability.
What is the severity rating of CVE-2026-96119?
The National Vulnerability Database rates CVE-2026-96119 as Critical with a CVSS score of 9.9.
Can an unauthenticated attacker exploit this flaw?
No, the source material specifies that a remote authenticated attacker is required to exploit this vulnerability.
