IBM i ACS 1.1.9.14 is now available – a security-focused update you should apply promptly.
IBM released ACS 1.1.9.14 on 5 August 2026 (build 6320), and this is primarily a security-focused update, not a feature release. This might not look like an exciting feature-packed release, but it is important. Even though there are no new Run SQL Scripts examples, IFS favourites, or schema actions this time, IBM has concentrated on closing several security holes that affected earlier versions.
As an IBM i consultant, I’d treat this one as a must-install update rather than an optional refresh. If you’re running ACS 1.1.9.13 or earlier, there’s little reason to delay because the fixes are security-related and IBM is specifically recommending customers move to 1.1.9.14.
For an IBM i shop, this is one of those updates that’s a bit like applying cumulative PTFs. Boring? Yes. Important? Also yes. 🙂
If you are still on 1.1.9.13 or older, treat this as a “do it this week” update.
Any new features?
From IBM’s release notes and community discussions, no significant new user-facing functions or enhancements were added in 1.1.9.14. This is essentially a “stay safe and stay current” release.
What IBM actually fixed
The official updates page is quite direct. All prior versions had issues that 1.1.9.14 addresses:
- Arbitrary code execution on Windows when ACS is installed for all users, caused by a publicly writable directory and configuration file.
- Injection of a rogue certificate authority via a publicly writable truststore.
- A zip-slip path traversal vulnerability when importing a configuration.
- Versions from 1.1.8.3 through 1.1.9.13 could download unverified product code when configured to pull updates from an IBM i partition.
- Sample scripts in the Linux/Mac documentation folder were vulnerable to arbitrary code execution from crafted input.
Two APARs were also closed:
- DT472544 — CA400EXP KEY is ignored in Index Advisor when the DESC keyword is used.
- DT473152 — ACSLAUNCH_WIN-64.EXE would not start on 1.1.9.12/1.1.9.13 if the native files were not sitting alongside the launcher.
New rules if you push updates from an IBM i
This is the part many shops will notice. Starting with 1.1.9.14, ACS is stricter about how it pulls updates from a central IBM i location (/QIBM/ProdData/Access/ACS/Base or a custom path).
- The system configuration used for com.ibm.iaccess.CheckUpdateSystem must have SSL/TLS enabled. ACS will refuse an unencrypted connection.
- Default IFS location permissions are now enforced: owner must be QSYS, *PUBLIC must not have write authority, no primary group, no AUTL, and no extra explicit authorities.
- A checksums.sha512 file must exist in the update directory. ACS verifies every downloaded file against it.
- Custom update paths have similar *PUBLIC write restrictions. IBM has even flagged custom paths as possibly being deprecated later.
If you use the IBM-supplied PTFs (SJ11043:SJ11046 depending on your IBM i release), those requirements are already satisfied. If you extract the zip yourself, you now have extra homework.
How to get 1.1.9.14
The simplest route for most people:
- Open ACS.
- Help → Check for Updates (or let the existing notification appear).
- Download and apply.
Alternatively, go to the IBM ACS downloads page (you will need an IBMid) and grab the latest zip. The next planned update after this one is December 2026.
After install, use Help | About and it should show version 1.1.9.14.
Bottom line
This is one of those “not exciting, but necessary” releases. The previous couple of versions already had security notes; 1.1.9.14 tightens things further, especially around Windows install hygiene and update-from-IBM-i trust.
If you run ACS in a shared or multi-user environment, or if you host the update files on an IBM i, apply this sooner rather than later. The new permission and checksum checks are there for a reason.
Keep your ACS current. The platform is still moving, and so is the tooling we use every day.
