IBM i: Code injection in HTTP Server Administration GUI
Summary
IBM i 7.3, 7.4, 7.5 and 7.6 contain an improper data sanitization flaw (CWE-94) in the HTTP Server Administration web application. A remote attacker with valid credentials for this admin interface can obtain sensitive information or execute arbitrary code on the system. IBM rates the issue CVSS 9.9 (Critical), as the attack needs only low privileges but changes scope and affects confidentiality, integrity and availability.
Affected
- IBM i 7.3
- IBM i 7.4
- IBM i 7.5
- IBM i 7.6
License program 5770-DG1 (HTTP Server), per IBM Security Bulletin 7292159.
Fixed in
- IBM i 7.6: PTF SJ11645
- IBM i 7.5: PTF SJ11644
- IBM i 7.4: PTF SJ11643
- IBM i 7.3: PTF SJ11641
IBM recommends upgrading unsupported versions to a supported, fixed release.
Workaround
IBM lists no workarounds or mitigations in the Security Bulletin. Until the PTF is applied, restrict access to the HTTP Server Administration GUI to trusted users only. This is third-party guidance, not an IBM recommendation.
Exploitation
- No evidence of exploitation in the wild found as of 26 Oct 2026 (third-party tracker).
- No public proof of concept confirmed in the sources reviewed.
- Not found in the CISA KEV catalog in the sources reviewed; verify directly.
- CISA SSVC: exploitation none, not automatable, total technical impact.
Our recommendation
- Identify all IBM i systems running 7.3 to 7.6 with the HTTP Server Administration GUI enabled.
- Apply the PTF for your release as soon as possible, especially if the admin GUI is reachable from outside the trusted network.
- Until patched, limit access to the admin GUI to trusted administrators and review which user profiles can reach it.
- Monitor authenticated sessions to the admin application for unusual activity.
- Apply other IBM HTTP Server Administration GUI fixes from the same period in the same maintenance window.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7292159 www.ibm.com
- OffSeq threat radar entry for CVE-2026-96119 radar.offseq.com
- IT Jungle IBM i PTF guide, volume 28, number 37 www.itjungle.com
- Vulners Rapid7 record for CVE-2026-96119 vulners.com
- CVE-2026-96119 threat-intel record cve.threatint.com
- dev.to analysis of CVE-2026-96119 dev.to
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 15:28.
Original description (NVD)
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.