Quick answers
- Is CVE-2026-93886 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93886 being exploited in the wild.
- How severe is CVE-2026-93886?
- High severity, with a CVSS score of 8.3, published 13 October 2026.
- Which products and versions are affected?
- IBM i 7.3, 7.4, 7.5, 7.6.
- Is there a fix for CVE-2026-93886?
- Yes: fixed in IBM i 7.3 with PTF SJ11641, 7.4 with PTF SJ11643, 7.5 with PTF SJ11644, 7.6 with PTF SJ11645. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-93886 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-93886?
- Check whether you run IBM I or IBM i at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: IBM i 7.3 with PTF SJ11641, 7.4 with PTF SJ11643, 7.5 with PTF SJ11644, 7.6 with PTF SJ11645
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the IBM i HTTP Server Administration GUI caused by improper input validation (CWE-79). An authenticated remote attacker can inject arbitrary script code through user-supplied input, which executes in the context of other users' sessions when they access the interface. No user interaction is required beyond the attacker being authenticated.
Affected products
- IBM IBM i 7.3, 7.4, 7.5, 7.6
Timeline
- 2026-10-13: disclosed