External risk intelligence

IBM i HTTP Server Administration Information Disclosure and Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-96119

The vulnerability affects the HTTP Server Administration web application in IBM i. Web-based administration interfaces and management consoles for servers are commonly deployed as network-accessible services, making them reachable via the internet or internal networks for administrative purposes.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in IBM i's HTTP Server Administration web application could permit an authenticated attacker to access sensitive information or run unauthorized code on the system. This issue stems from inadequate handling of data within the application, potentially impacting systems that utilize this administrative interface for managing IBM i servers.

Unauthorized access to data or code execution.
Affects critical IBM i server administration.
Confirm relevance and understand exposure.

Attack Path

How an attacker could exploit the issue

An attacker with valid credentials could exploit a flaw in the IBM i HTTP Server Administration web application. By sending specially crafted data, they could cause the application to improperly handle information, potentially leading to the disclosure of sensitive data or the execution of unauthorized code on the system.

Attacker needs prior authentication.
Triggered by unsanitized data in web app.
Risk of sensitive data exposure or code execution.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could exploit an improper data sanitization flaw in the IBM i HTTP Server Administration web application to gain unauthorized access to sensitive information or execute arbitrary code. This vulnerability could affect system data and service behavior when the administration application is accessible.

System data and service behavior.
When the administration application is accessible.
Sensitive information disclosure or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for managing IBM i systems. The first step is to identify all instances of the affected IBM i versions, determine their exposure and criticality, and confirm ownership before planning remediation.

Identify affected IBM i systems and owners.
Verify external reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM i and its HTTP Server Administration component?

IBM i is an integrated operating system designed for enterprise-grade hardware, known for its high availability and security. The HTTP Server Administration interface is a web-based management tool built into the platform, allowing administrators to configure, monitor, and manage web server environments remotely through a browser instead of traditional command-line interfaces.

What does CVE-2026-96119 mean by improper data sanitization?

This vulnerability is classified as CWE-94, which involves improper control of generation of code. In this context, the HTTP Server Administration application fails to properly filter or validate the input it receives from users. Because it treats malicious input as legitimate commands or code, an attacker can manipulate the application to leak sensitive information or force the server to perform unauthorized actions.

Do I need to be logged in to trigger this vulnerability?

Yes, this flaw requires the attacker to have valid credentials to access the HTTP Server Administration web application first. It is not triggered by simply sending generic web requests to a public-facing page; the attacker must be able to authenticate as a user before they can submit the specific, malformed data that exploits the sanitization weakness.

How do I know if my system is at risk according to Halo Surface Signal?

Halo Surface Signal indicates that because this web-based administration interface is frequently configured to be reachable over networks for management convenience, it often presents a broader attack surface. If your HTTP Server Administration console is accessible from your wider internal network or the internet, it is at higher risk than an isolated system.

When should I prioritize fixing this for my IBM i environment?

Start by identifying all IBM i systems running versions 7.3 through 7.6 to determine where this administration interface is active. Once identified, confirm which systems are business-critical and accessible via the network. After assessing the exposure of these instances, you should prioritize applying updates to the most reachable and sensitive management consoles first.

References

www.ibm.com/support/pages/node/7292159

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.