Fix IBM i HTTP Server Admin Sanitization Bug to Stop Critical RCE on Versions 7.3 to 7.6

Security teams managing IBM i environments must address a severe vulnerability in the HTTP Server Administration component. The flaw, identified as CVE-2026-96119, allows remote authenticated users to execute arbitrary code on affected systems. According to the National Vulnerability Database, this issue is rated critical with a CVSS score of 9.9. The weakness enables attackers to potentially obtain sensitive information or gain full control over the server infrastructure.

Root cause

The underlying technical issue involves improper data sanitization within the HTTP Server Administration web application. This specific weakness is categorized under CWE-94, which refers to code injection vulnerabilities. When the application fails to properly sanitize incoming data, it creates an opening for malicious input to be processed as executable commands. This lack of validation allows attackers to inject their own code into the server’s execution flow.

Attack path

Exploitation of this vulnerability requires the attacker to possess valid authentication credentials for the system. Once logged in, a remote attacker can interact with the HTTP Server Administration interface. By sending specially crafted requests that bypass the flawed sanitization checks, the attacker can trigger arbitrary code execution. This path allows the adversary to run commands on the host system, potentially leading to data theft or further lateral movement within the network.

Affected versions

The vulnerability impacts multiple releases of the IBM i operating system. Security administrators should verify their current version against the list of affected releases. The following versions are confirmed to contain the flaw:

• IBM i 7.3
• IBM i 7.4
• IBM i 7.5
• IBM i 7.6

Organizations running any of these versions are exposed to the risk of remote code execution if the HTTP Server Administration component is accessible to authenticated users.

Mitigation

Current records do not confirm the availability of a patch or official fix for this specific CVE. Until a vendor update is released, organizations should focus on limiting exposure. Restricting access to the HTTP Server Administration interface to essential personnel only reduces the pool of potential attackers. Disabling the component entirely, if business operations allow, eliminates the attack surface associated with this specific web application.

What to do and how to stay safe: IBM

• Audit all user accounts with access to the HTTP Server Administration interface and remove unnecessary privileges immediately.
• Monitor server logs for unusual command execution or data access patterns originating from authenticated admin sessions.
• Isolate systems running IBM i 7.3 through 7.6 from untrusted networks until a vendor patch is confirmed available.
• Verify that multi-factor authentication is enforced for all administrative accounts to raise the bar for initial access.

Step-by-step guide: Vulnerability Management Definition and Process

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96119?

The vulnerability has a CVSS score of 9.9, which is rated as critical severity.

Which IBM i versions are affected by this flaw?

IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by this improper data sanitization issue.

Does an attacker need to be logged in to exploit this?

Yes, the vulnerability requires a remote authenticated attacker to execute arbitrary code or obtain sensitive information.