CVE-2026-14875

This CVE exposes a world-writable directory created during IBM Access Client Solutions installation that persists across versions 1.1.2.0 through 1.1.9.13. The vulnerability is a classic DLL planting vector: any local user can drop a malicious DLL into this directory, which then loads with the privilege level of the application that invokes it. The CVSS 7.8 score significantly understates the real blast radius—IBM Access Client Solutions is a connectivity bridge to IBM i systems running ERP, financial, and supply chain workloads. If the application uses credentials or elevated sessions to reach those backends, a compromised DLL on the workstation becomes a pivot point into the enterprise infrastructure, not merely local privilege escalation. The most critical attack surface is not the initial installation but the upgrade mechanism. When the product updates, the installer may recreate or reset the directory without preserving any permission hardening applied after the initial install. This means the vulnerability is not a one-time condition to fix—it reintroduces itself with each patch cycle unless the upgrade routine itself explicitly locks down ACLs. Testing for this vulnerability requires executing the installed application as a non-privileged user; developers testing on their own admin accounts will never observe the world-writable condition. Remediation must address both the current installation and the upgrade path. First, identify the vulnerable directory—typically within the program files hierarchy where the application stores runtime components—and verify its ACLs deny write access to the Users or Authenticated Users group. Second, examine the installer and upgrade mechanism to ensure it explicitly sets restrictive ACLs on directories it creates, not relying on inherited defaults. Finally, consider the downstream risk: if this client application connects to IBM i systems with privileged credentials, the compromise surface extends far beyond the local workstation. A non-privileged user with DLL planting capability on the endpoint has a potential path to your ERP. This pattern is not novel. DLL planting via world-writable install directories has recurred across vendors and installer technologies for decades—the same vulnerability class that plagued Windows 95/98 installers resurfaced in .NET installer frameworks and again in cross-platform tools like the one IBM used here. The persistence across seventeen versions suggests the fix, if attempted, was not durable—or more likely, no process ever existed to catch this class of flaw in post-installation state. Organizations relying on this connectivity client should audit both the installed directory permissions and the upgrade mechanism, not merely apply the patch and assume the vulnerability is closed.

Reviewed through automated stages and approved by a human before publication.