Apply Fixes for IBM i HTTP Server Admin to Mitigate Critical CVE-2026-96119 Authenticated RCE Threat

Remote authenticated attackers can compromise IBM i systems through a critical flaw in the HTTP Server Administration web application. The National Vulnerability Database lists CVE-2026-96119 with a CVSS score of 9.9, indicating severe risk. This vulnerability affects IBM i versions 7.3, 7.4, 7.5, and 7.6, exposing organisations that have not yet applied fixes to potential system takeover or data breach scenarios.

How does the vulnerability exploit the system?

The issue stems from improper data sanitisation within the HTTP Server Administration web application. According to the NVD record, this weakness aligns with CWE-94, which involves code injection flaws. Because the application fails to properly sanitise input, a remote attacker who has already authenticated to the system can manipulate the data flow. This manipulation allows the attacker to inject and execute arbitrary code directly on the host system, bypassing standard security controls.

Which IBM i versions are affected?

The vulnerability impacts four specific major releases of the IBM i operating system. Affected versions include IBM i 7.3, 7.4, 7.5, and 7.6. Organisations running any of these versions with the HTTP Server Administration component enabled are at risk. The NVD record explicitly lists these four versions as susceptible to the improper data sanitisation flaw, meaning users of older or newer releases are not identified as affected in this specific advisory.

What are the potential consequences of exploitation?

An attacker who successfully exploits CVE-2026-96119 can achieve two primary outcomes. First, they can execute arbitrary code on the system, potentially gaining full control over the server. Second, they may obtain sensitive information stored on the compromised machine. The critical rating reflects the severity of these outcomes, particularly given that the attack vector is remote and only requires initial authentication, which is often easier to obtain than unauthenticated access.

Is a fix available for this issue?

No fix has been confirmed yet in the provided source material. The NVD record describes the vulnerability and its severity but does not mention the release of a patch, update, or mitigation guide from IBM. Organisations should monitor official IBM security advisories for updates. Until a vendor-provided solution is released, the risk remains active for all affected versions listed in the advisory.

What to do and how to stay safe: IBM i

• Audit your IBM i environment to identify if versions 7.3, 7.4, 7.5, or 7.6 are in production.
• Review access logs for the HTTP Server Administration web application for unusual authenticated activity.
• Restrict access to the administration interface to trusted IP addresses where possible.
• Monitor for official patches from IBM and apply them immediately once available.

Step-by-step guide: Emergency Patching: The High Cost of Fixing Critical Flaws Fast

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-96119?

The CVSS score for CVE-2026-96119 is 9.9, which is classified as critical.

Do I need to be authenticated to exploit this flaw?

Yes, the vulnerability requires a remote authenticated attacker to execute arbitrary code or obtain sensitive information.

Which IBM i versions are vulnerable?

IBM i versions 7.3, 7.4, 7.5, and 7.6 are affected by this vulnerability.