ACS review: the licensing trap and the Jan 2026 CVE fix people should know about

Wrote up an honest take on IBM i Access Client Solutions since I couldn't find anything online that wasn't either IBM's own marketing copy or a straight reference guide with no actual opinion attached. Short version: it's free with any IBM i entitlement, it's genuinely cross-platform now, and Run SQL Scripts plus Visual Explain alone are worth opening it for if you've been ignoring everything past the 5250 emulator.

Two things worth flagging if you're not already on top of them. First, the base ACS download does not include the ODBC/.NET drivers, those live in a separate Application Package that's easy to skip during install and then bite you three months later when some Python or .NET integration can't connect. Second, version 1.1.9.11 from January shipped a critical fix for CVE-2025-66516, an XML External Entity injection reachable through Run SQL Scripts via Apache Tika. IBM told people to stop using the three versions before it. If your shop treats ACS updates as optional housekeeping, this is the one that should have changed that.

Also went into what's still rough (Java startup lag, the IFS browser hasn't been touched visually in years, 32-bit Windows support is gone) if anyone wants the full breakdown before rolling out an update shopwide.

https://prompteddev.com/blog/ibm-i-access-client-solutions-review