CVE-2026-96119 is a critical (CVSS 9.9) code injection vulnerability in the HTTP Server Administration web application on IBM i 7.3 through 7.6. A remote authenticated attacker could use it to obtain sensitive information or execute arbitrary code.
What Is It
The flaw is in the HTTP Server Administration web application that ships with IBM i. IBM says the application does not sanitize data properly, so a remote attacker who is logged in can obtain sensitive information or run arbitrary code on the system. The weakness is classified as CWE-94 (Improper Control of Generation of Code, or "Code Injection").
IBM's PSIRT ([email protected]) has published the record. Its NVD status is currently "Received," meaning NVD has not yet run its own analysis.
Why It Matters
IBM rates the vulnerability 9.9 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network-exploitable: the attacker does not need local access.
- Low attack complexity: no special conditions are needed for the attack to work.
- Low privileges required: an attacker needs only basic authenticated access, not administrator rights.
- No user interaction: no victim has to click or open anything.
- Scope changed: a successful attack can affect resources beyond the vulnerable component.
- High impact to confidentiality, integrity, and availability.
The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE. Active exploitation is not confirmed by KEV as of this writing. Still, the low bar to exploit and the code execution outcome make it a high priority for any organization running affected IBM i systems. The danger is greatest where many authenticated users can reach the HTTP Server Administration interface.
What's Vulnerable
The NVD record lists the following IBM i versions as affected:
- IBM i 7.3
- IBM i 7.4
- IBM i 7.5
- IBM i 7.6
Matching CPEs: cpe:2.3:a:ibm:i:7.3, 7.4, 7.5, and 7.6.
The vulnerable component is the HTTP Server Administration web application.
Patch Status
The NVD data available for this brief does not include fixed versions, PTF numbers, or workaround details. IBM has published a security bulletin for this vulnerability (linked below). Administrators should check it for the fixes and remediation steps for their release. There is no CISA KEV entry, so no federal remediation deadline or KEV required action applies at this time.
Until fixes are in place, a reasonable precaution is to limit who can log in to and reach the HTTP Server Administration interface.
Sources
- IBM Security Bulletin – CVE-2026-96119
- NVD – CVE-2026-96119
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE)