CVE-2026-16695

The CVSS 7.8 rating for CVE-2026-16695 fundamentally misrepresents the actual risk profile. This is a command injection vulnerability in IBM i Access Client Solutions spanning versions 1.1.2.0 through 1.1.9.13—roughly 15 releases. The flaw persisted across years of releases not because developers lacked safe alternatives, but because command injection patterns inherit through codebases like genetic traits: someone wrote unsafe shell commands in an early version, and every subsequent release carried that vulnerability forward because refactoring 'what works' is harder than adding features. That 15-version span is a development process failure, not a risk calculation one. The 'local attacker' qualifier in the CVE is the critical misconception to discard. IBM i Access Client Solutions is the bridge between standard Windows workstations and systems running banking, healthcare supply chain, manufacturing, and government logistics software. In enterprise deployments, this client frequently operates with privileged service accounts and auto-logon configurations because organizations treat it as infrastructure rather than application software. The 'local attacker' prerequisite effectively collapses in these environments—anyone with physical or remote access to a domain-joined workstation that hasn't been patched in six months satisfies the condition. The compound risk is what makes this dangerous: local code execution plus credential inheritance plus mission-critical backend access. If exploitation yields IBM i credentials or session tokens that persist beyond the compromised endpoint—and the evidence from similar IBM i access tools suggests this is the architectural norm—then the blast radius propagates into every system those credentials touch. That cascade isn't modeled by CVSS at all. Additionally, enterprise change management processes for IBM i systems routinely stretch patch deployment to 60-90 days, sometimes longer for systems touching financial ledgers. The same organizational inertia that tolerated years of exposure to vulnerable code will tolerate slow remediation now. The EPSS score of 0.0015 will cause automated systems to deprioritize this, compounding the exposure window precisely in the environments where it matters most. Prioritize patching this client on any workstation with access to IBM i systems, treat the 'local attacker' requirement as effectively satisfied in typical enterprise deployments, and assume credential inheritance until proven otherwise.

Reviewed through automated stages and approved by a human before publication.