CVE-2026-13433

CriticalCVSS 9.6/10Last modified Oct 23, 2026

Description

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-494

Affected software

VendorProductVersions
IBMi Access Client Solutions>= 1.1.2.0, <= 1.1.9.13

References

Timeline

Published
Aug 12, 2026
Last modified
Oct 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-134344.9A flaw was found in KubeVirt's network annotation generator. When a tenant creates a VirtualMachineInstance with a Multus network configuratCVE-2026-134359.9IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation.CVE-2026-134376.5Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticatCVE-2026-134399.8The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versionsCVE-2026-13445.5Tanium addressed an insecure file permissions vulnerability in Enforce Recovery Key Portal.CVE-2026-134407.2The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulneraCVE-2026-134417.2The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'new_event_CVE-2026-134427.1IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and CVE-2026-134436.4The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson AttachmentCVE-2026-134448.1IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow witCVE-2026-134458.1IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another useCVE-2026-134469.8IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own in
CVE-2026-13433: Critical severity, CVSS 9.6 | Vulnix