Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-93005 (GCVE-0-2026-93005)

Vulnerability from cvelistv5 – Published: 2026-11-08 18:46 – Updated: 2026-11-08 18:46

Title

Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026

Summary

IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

ibm CNA

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7294875	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	Process Mining	Affected: 2.0.0 , ≤ 2.2.1 (semver) cpe:2.3:a:ibm:process_mining:2.0.0:::::::* cpe:2.3:a:ibm:process_mining:2.2.1:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"
          ],
          "product": "Process Mining",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "2.2.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients.\u003c/p\u003e"
            }
          ],
          "value": "IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T18:46:24.333Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7294875"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003eVersion(s) number and/or range\u00a0\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Process Mining OCP\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cp\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\u003cbr/\u003e\u003cbr/\u003eUpgrade to version 2.2.1 IF001\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003euniIBM Process Mining On-Prem\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cdiv\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\u003cbr/\u003e\u003cbr/\u003eSteps\u003cbr/\u003e1. Go to IBM Support Portal\u003cbr/\u003eNavigate to \u003ca href=\"https://ibm.com/mysupport\" rel=\"nofollow\"\u003ehttps://ibm.com/mysupport\u003c/a\u003e and sign in with your IBMid before proceeding.\u003cbr/\u003e2. Open a case\u003c/div\u003e\u003cul\u003e\u003cli\u003eClick \"Open a case\" from the support portal.\u003c/li\u003e\u003cli\u003eSelect IBM Process Mining as the product.\u003c/li\u003e\u003cli\u003eFill in the case details, referencing the published security advisory: \u003ca href=\"https://www.ibm.com/support/pages/node/7294875\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7294875\u003c/a\u003e\u003c/li\u003e\u003cli\u003eRequest the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e3. Obtain the fix\u003cbr/\u003eThe interim fix will be delivered directly through your support case once it has been opened.\u003c/div\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
            }
          ],
          "value": "Product(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM Process Mining OCP2.0.0 - 2.2.1\n\nIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\n\nUpgrade to version 2.2.1 IF001\n https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001 \n\n\n\n\n\nuniIBM Process Mining On-Prem2.0.0 - 2.2.1IBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\n\nSteps\n1. Go to IBM Support Portal\nNavigate to  https://ibm.com/mysupport  and sign in with your IBMid before proceeding.\n2. Open a case\n\n  *  Click \"Open a case\" from the support portal.\n  *  Select IBM Process Mining as the product.\n  *  Fill in the case details, referencing the published security advisory:  https://www.ibm.com/support/pages/node/7294875 \n  *  Request the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\n\n\n3. Obtain the fix\nThe interim fix will be delivered directly through your support case once it has been opened."
        }
      ],
      "title": "Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-93005",
    "datePublished": "2026-11-08T18:46:24.333Z",
    "dateReserved": "2026-09-17T14:31:27.823Z",
    "dateUpdated": "2026-11-08T18:46:24.333Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-114464 (GCVE-0-2026-114464)

Vulnerability from cvelistv5 – Published: 2026-11-08 17:00 – Updated: 2026-11-09 20:02

Title

Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026

Summary

IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.

Severity

9.3 (Critical)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 20:02 UTC

CWE

CWE-284 - Improper Access Control

Assigner

ibm CNA

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7294875	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	Process Mining	Affected: 2.0.0 , ≤ 2.2.1 (semver) cpe:2.3:a:ibm:process_mining:2.0.0:::::::* cpe:2.3:a:ibm:process_mining:2.2.1:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-114464",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T20:02:31.614574Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T20:02:43.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"
          ],
          "product": "Process Mining",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "2.2.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.\u003c/p\u003e"
            }
          ],
          "value": "IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T17:00:10.527Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7294875"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003eVersion(s) number and/or range\u00a0\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Process Mining OCP\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cp\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\u003cbr/\u003e\u003cbr/\u003eUpgrade to version 2.2.1 IF001\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003euniIBM Process Mining On-Prem\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cdiv\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\u003cbr/\u003e\u003cbr/\u003eSteps\u003cbr/\u003e1. Go to IBM Support Portal\u003cbr/\u003eNavigate to \u003ca href=\"https://ibm.com/mysupport\" rel=\"nofollow\"\u003ehttps://ibm.com/mysupport\u003c/a\u003e and sign in with your IBMid before proceeding.\u003cbr/\u003e2. Open a case\u003c/div\u003e\u003cul\u003e\u003cli\u003eClick \"Open a case\" from the support portal.\u003c/li\u003e\u003cli\u003eSelect IBM Process Mining as the product.\u003c/li\u003e\u003cli\u003eFill in the case details, referencing the published security advisory: \u003ca href=\"https://www.ibm.com/support/pages/node/7294875\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7294875\u003c/a\u003e\u003c/li\u003e\u003cli\u003eRequest the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e3. Obtain the fix\u003cbr/\u003eThe interim fix will be delivered directly through your support case once it has been opened.\u003c/div\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
            }
          ],
          "value": "Product(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM Process Mining OCP2.0.0 - 2.2.1\n\nIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\n\nUpgrade to version 2.2.1 IF001\n https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001 \n\n\n\n\n\nuniIBM Process Mining On-Prem2.0.0 - 2.2.1IBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\n\nSteps\n1. Go to IBM Support Portal\nNavigate to  https://ibm.com/mysupport  and sign in with your IBMid before proceeding.\n2. Open a case\n\n  *  Click \"Open a case\" from the support portal.\n  *  Select IBM Process Mining as the product.\n  *  Fill in the case details, referencing the published security advisory:  https://www.ibm.com/support/pages/node/7294875 \n  *  Request the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\n\n\n3. Obtain the fix\nThe interim fix will be delivered directly through your support case once it has been opened."
        }
      ],
      "title": "Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-114464",
    "datePublished": "2026-11-08T17:00:10.527Z",
    "dateReserved": "2026-10-21T15:01:58.773Z",
    "dateUpdated": "2026-11-09T20:02:43.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-112369 (GCVE-0-2026-112369)

Vulnerability from cvelistv5 – Published: 2026-11-08 16:57 – Updated: 2026-11-08 16:57

Title

Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026

Summary

IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-602 - Client-Side Enforcement of Server-Side Security

Assigner

ibm CNA

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7294875	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	Process Mining	Affected: 2.0.0 , ≤ 2.2.1 (semver) cpe:2.3:a:ibm:process_mining:2.0.0:::::::* cpe:2.3:a:ibm:process_mining:2.2.1:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"
          ],
          "product": "Process Mining",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "2.2.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.\u003c/p\u003e"
            }
          ],
          "value": "IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-602",
              "description": "CWE-602 Client-Side Enforcement of Server-Side Security",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T16:57:33.479Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7294875"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003eVersion(s) number and/or range\u00a0\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Process Mining OCP\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cp\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\u003cbr/\u003e\u003cbr/\u003eUpgrade to version 2.2.1 IF001\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003euniIBM Process Mining On-Prem\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cdiv\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\u003cbr/\u003e\u003cbr/\u003eSteps\u003cbr/\u003e1. Go to IBM Support Portal\u003cbr/\u003eNavigate to \u003ca href=\"https://ibm.com/mysupport\" rel=\"nofollow\"\u003ehttps://ibm.com/mysupport\u003c/a\u003e and sign in with your IBMid before proceeding.\u003cbr/\u003e2. Open a case\u003c/div\u003e\u003cul\u003e\u003cli\u003eClick \"Open a case\" from the support portal.\u003c/li\u003e\u003cli\u003eSelect IBM Process Mining as the product.\u003c/li\u003e\u003cli\u003eFill in the case details, referencing the published security advisory: \u003ca href=\"https://www.ibm.com/support/pages/node/7294875\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7294875\u003c/a\u003e\u003c/li\u003e\u003cli\u003eRequest the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e3. Obtain the fix\u003cbr/\u003eThe interim fix will be delivered directly through your support case once it has been opened.\u003c/div\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
            }
          ],
          "value": "Product(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM Process Mining OCP2.0.0 - 2.2.1\n\nIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\n\nUpgrade to version 2.2.1 IF001\n https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001 \n\n\n\n\n\nuniIBM Process Mining On-Prem2.0.0 - 2.2.1IBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\n\nSteps\n1. Go to IBM Support Portal\nNavigate to  https://ibm.com/mysupport  and sign in with your IBMid before proceeding.\n2. Open a case\n\n  *  Click \"Open a case\" from the support portal.\n  *  Select IBM Process Mining as the product.\n  *  Fill in the case details, referencing the published security advisory:  https://www.ibm.com/support/pages/node/7294875 \n  *  Request the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\n\n\n3. Obtain the fix\nThe interim fix will be delivered directly through your support case once it has been opened."
        }
      ],
      "title": "Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-112369",
    "datePublished": "2026-11-08T16:57:33.479Z",
    "dateReserved": "2026-10-19T15:49:50.662Z",
    "dateUpdated": "2026-11-08T16:57:33.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108292 (GCVE-0-2026-108292)

Vulnerability from cvelistv5 – Published: 2026-11-08 16:55 – Updated: 2026-11-09 20:03

Title

Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026

Summary

IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 20:03 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

ibm CNA

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7294875	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	Process Mining	Affected: 2.0.0 , ≤ 2.2.1 (semver) cpe:2.3:a:ibm:process_mining:2.0.0:::::::* cpe:2.3:a:ibm:process_mining:2.2.1:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108292",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T20:03:40.064048Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T20:03:49.480Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"
          ],
          "product": "Process Mining",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "2.2.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened.\u003c/p\u003e"
            }
          ],
          "value": "IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T16:55:44.717Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7294875"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003eVersion(s) number and/or range\u00a0\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Process Mining OCP\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cp\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\u003cbr/\u003e\u003cbr/\u003eUpgrade to version 2.2.1 IF001\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003euniIBM Process Mining On-Prem\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cdiv\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\u003cbr/\u003e\u003cbr/\u003eSteps\u003cbr/\u003e1. Go to IBM Support Portal\u003cbr/\u003eNavigate to \u003ca href=\"https://ibm.com/mysupport\" rel=\"nofollow\"\u003ehttps://ibm.com/mysupport\u003c/a\u003e and sign in with your IBMid before proceeding.\u003cbr/\u003e2. Open a case\u003c/div\u003e\u003cul\u003e\u003cli\u003eClick \"Open a case\" from the support portal.\u003c/li\u003e\u003cli\u003eSelect IBM Process Mining as the product.\u003c/li\u003e\u003cli\u003eFill in the case details, referencing the published security advisory: \u003ca href=\"https://www.ibm.com/support/pages/node/7294875\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7294875\u003c/a\u003e\u003c/li\u003e\u003cli\u003eRequest the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e3. Obtain the fix\u003cbr/\u003eThe interim fix will be delivered directly through your support case once it has been opened.\u003c/div\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
            }
          ],
          "value": "Product(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM Process Mining OCP2.0.0 - 2.2.1\n\nIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\n\nUpgrade to version 2.2.1 IF001\n https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001 \n\n\n\n\n\nuniIBM Process Mining On-Prem2.0.0 - 2.2.1IBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\n\nSteps\n1. Go to IBM Support Portal\nNavigate to  https://ibm.com/mysupport  and sign in with your IBMid before proceeding.\n2. Open a case\n\n  *  Click \"Open a case\" from the support portal.\n  *  Select IBM Process Mining as the product.\n  *  Fill in the case details, referencing the published security advisory:  https://www.ibm.com/support/pages/node/7294875 \n  *  Request the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\n\n\n3. Obtain the fix\nThe interim fix will be delivered directly through your support case once it has been opened."
        }
      ],
      "title": "Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-108292",
    "datePublished": "2026-11-08T16:55:44.717Z",
    "dateReserved": "2026-10-09T18:00:53.361Z",
    "dateUpdated": "2026-11-09T20:03:49.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-36016 (GCVE-0-2025-36016)

Vulnerability from cvelistv5 – Published: 2025-06-21 12:38 – Updated: 2025-08-24 11:43

Title

IBM Process Mining HTTP open redirect

Summary

IBM Process Mining 2.0.1 IF001 and 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-23 15:00 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

ibm CNA

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7237502	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	Process Mining	Affected: 2.0.1 Affected: 2.0.1 IF001 cpe:2.3:a:ibm:process_mining:2.0.1:::::::* cpe:2.3:a:ibm:process_mining:2.0.1:interm_fix1::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-36016",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-23T15:00:18.294484Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-23T15:00:24.688Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:process_mining:2.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:process_mining:2.0.1:interm_fix1:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Process Mining",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.1"
            },
            {
              "status": "affected",
              "version": "2.0.1 IF001"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Process Mining 2.0.1 IF001 and 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim."
            }
          ],
          "value": "IBM Process Mining 2.0.1 IF001 and 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-24T11:43:03.984Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7237502"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Process Mining  2.0.1 IF001, 2.0.1  \u003cbr\u003eUpgrade to version 2.0.2\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/docs/en/process-mining/2.0.2\"\u003ehttps://www.ibm.com/docs/en/process-mining/2.0.2\u003c/a\u003e\u003cbr\u003e"
            }
          ],
          "value": "IBM Process Mining  2.0.1 IF001, 2.0.1  \nUpgrade to version 2.0.2\n https://www.ibm.com/docs/en/process-mining/2.0.2"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Process Mining HTTP open redirect",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-36016",
    "datePublished": "2025-06-21T12:38:18.175Z",
    "dateReserved": "2025-04-15T21:16:07.862Z",
    "dateUpdated": "2025-08-24T11:43:03.984Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

5 vulnerabilities found for Process Mining by IBM

CVE-2026-93005 (GCVE-0-2026-93005)

CVE-2026-114464 (GCVE-0-2026-114464)

CVE-2026-112369 (GCVE-0-2026-112369)

CVE-2026-108292 (GCVE-0-2026-108292)

CVE-2025-36016 (GCVE-0-2025-36016)