Search
Find a vulnerability
Search criteria
6812 vulnerabilities by ibm
CVE-2026-118904 (GCVE-0-2026-118904)
Vulnerability from cvelistv5 – Published: 2026-11-08 19:48 – Updated: 2026-11-08 19:48
VLAI
EPSS
VEX
Title
IBM webMethods Integration Server is affected by vulnerabilty in backup code validation during 2FA Authentication.
Summary
IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
Severity
8.1 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7295306 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | webMethods Integration Server |
Affected:
12.1
cpe:2.3:a:ibm:webmethods_integration_server:12.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:webmethods_integration_server:12.1.0:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:webmethods_integration_server:12.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:webmethods_integration_server:12.1.0:*:*:*:*:*:*:*"
],
"product": "webMethods Integration Server",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.\u003c/p\u003e"
}
],
"value": "IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T19:48:22.159Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7295306"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eIBM strongly recommends addressing the vulnerability now by applying the mentioned core fixes or later core fixes for the affected versions and following the respective fix readme\u00a0document.\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003eIS_12.1_Core_Fix1 or later\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003eFixes can be downloaded and installed via IBM webMethods Update Manager. Refer to \u003ca href=\"https://www.ibm.com/support/pages/node/7232491\" rel=\"nofollow\"\u003eHow to Download webMethods Software\u003c/a\u003e\u003c/div\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by applying the mentioned core fixes or later core fixes for the affected versions and following the respective fix readme\u00a0document.\n\n\n\nIS_12.1_Core_Fix1 or later\n\n\n\nFixes can be downloaded and installed via IBM webMethods Update Manager. Refer to How to Download webMethods Software https://www.ibm.com/support/pages/node/7232491"
}
],
"title": "IBM webMethods Integration Server is affected by vulnerabilty in backup code validation during 2FA Authentication."
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-118904",
"datePublished": "2026-11-08T19:48:22.159Z",
"dateReserved": "2026-10-29T05:03:43.393Z",
"dateUpdated": "2026-11-08T19:48:22.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96146 (GCVE-0-2026-96146)
Vulnerability from cvelistv5 – Published: 2026-11-08 19:44 – Updated: 2026-11-08 19:44
VLAI
EPSS
VEX
Title
Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management
Summary
IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
Severity
7.5 (High)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7289655 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | SevOne Network Performance Management |
Affected:
7.0.0 , ≤ 8.2.2
(semver)
cpe:2.3:a:ibm:sevone_network_performance_management:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:sevone_network_performance_management:8.2.2:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:sevone_network_performance_management:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:sevone_network_performance_management:8.2.2:*:*:*:*:*:*:*"
],
"product": "SevOne Network Performance Management",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "8.2.2",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.\u003c/p\u003e"
}
],
"value": "IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T19:44:23.101Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7289655"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cem\u003e\u003cstrong\u003eIBM SevOne Network Performance Management has previously remediated the vulnerabilities listed in this bulletin through product maintenance and updates.\u00a0\u003c/strong\u003e\u003c/em\u003e\u003c/div\u003e\u003cdiv\u003e\u003cem\u003eThis security bulletin is being published as a historical reference to align with current security disclosure practices and does not contain new findings.\u003c/em\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eIBM strongly recommends addressing these vulnerabilities now by upgrading. Please refer to the instructions below for installation steps for your specific version.\u003c/p\u003e\u003cfigure\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003e\u003cp\u003eLatest Version(s)\u00a0\u003c/p\u003e\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM SevOne Network Performance Management (DI)\u003c/td\u003e\u003ctd\u003e8.2.4\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management\u0026amp;fixids=8.2.0-IBM-SevOne-DI_8.2.4\u0026amp;source=SAR\" rel=\"noopener noreferrer nofollow\"\u003eDownload\u003c/a\u003e and refer to the \u003ca href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=insight-data-82-release-notes\" rel=\"nofollow\"\u003erelease notes\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM SevOne Network Performance Management (NMS)\u003c/td\u003e\u003ctd\u003e8.2.3\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management\u0026amp;fixids=8.2.0-IBM-SevOne-NMS_8.2.3\u0026amp;source=dbluesearch\u0026amp;function=fixId\u0026amp;parent=ibm/Other%20software\" rel=\"noopener noreferrer nofollow\"\u003eDownload\u003c/a\u003e and refer to the \u003ca href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=nms-82-release-notes\" rel=\"noopener noreferrer nofollow\"\u003erelease notes\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM SevOne Network Performance Management (SD-WAN)\u003c/td\u003e\u003ctd\u003e8.2.3\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management\u0026amp;fixids=8.2.0-IBM-SevOne-SDWAN_8.2.3\u0026amp;source=SAR\u0026amp;function=fixId\u0026amp;parent=ibm/Other%20software\" rel=\"noopener noreferrer nofollow\"\u003eDownload\u003c/a\u003e and refer to the \u003ca href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=wan-sd-82-release-notes\" rel=\"noopener noreferrer nofollow\"\u003erelease notes\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/figure\u003e\u003c/div\u003e"
}
],
"value": "IBM SevOne Network Performance Management has previously remediated the vulnerabilities listed in this bulletin through product maintenance and updates.\u00a0\n\nThis security bulletin is being published as a historical reference to align with current security disclosure practices and does not contain new findings.\n\n\n\nIBM strongly recommends addressing these vulnerabilities now by upgrading. Please refer to the instructions below for installation steps for your specific version.\n\nProduct(s)\n\nLatest Version(s)\u00a0\n\nRemediation/Fix/InstructionsIBM SevOne Network Performance Management (DI)8.2.4 Download https://www.ibm.com/support/fixcentral/quickorder and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0 IBM SevOne Network Performance Management (NMS)8.2.3 Download https://www.ibm.com/support/fixcentral/swg/selectFixes and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0 IBM SevOne Network Performance Management (SD-WAN)8.2.3 Download https://www.ibm.com/support/fixcentral/swg/selectFixes and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0"
}
],
"title": "Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-96146",
"datePublished": "2026-11-08T19:44:23.101Z",
"dateReserved": "2026-09-22T18:37:41.901Z",
"dateUpdated": "2026-11-08T19:44:23.101Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95867 (GCVE-0-2026-95867)
Vulnerability from cvelistv5 – Published: 2026-11-08 19:44 – Updated: 2026-11-09 01:21
VLAI
EPSS
VEX
Title
Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management
Summary
IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 01:20 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7289655 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | SevOne Network Performance Management |
Affected:
7.0.0 , ≤ 8.2.2
(semver)
cpe:2.3:a:ibm:sevone_network_performance_management:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:sevone_network_performance_management:8.2.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95867",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T01:20:55.462977Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T01:21:10.563Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:sevone_network_performance_management:7.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:sevone_network_performance_management:8.2.2:*:*:*:*:*:*:*"
],
"product": "SevOne Network Performance Management",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "8.2.2",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow.\u003c/p\u003e"
}
],
"value": "IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T19:44:13.593Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7289655"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cem\u003e\u003cstrong\u003eIBM SevOne Network Performance Management has previously remediated the vulnerabilities listed in this bulletin through product maintenance and updates.\u00a0\u003c/strong\u003e\u003c/em\u003e\u003c/div\u003e\u003cdiv\u003e\u003cem\u003eThis security bulletin is being published as a historical reference to align with current security disclosure practices and does not contain new findings.\u003c/em\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eIBM strongly recommends addressing these vulnerabilities now by upgrading. Please refer to the instructions below for installation steps for your specific version.\u003c/p\u003e\u003cfigure\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003e\u003cp\u003eLatest Version(s)\u00a0\u003c/p\u003e\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM SevOne Network Performance Management (DI)\u003c/td\u003e\u003ctd\u003e8.2.4\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management\u0026amp;fixids=8.2.0-IBM-SevOne-DI_8.2.4\u0026amp;source=SAR\" rel=\"noopener noreferrer nofollow\"\u003eDownload\u003c/a\u003e and refer to the \u003ca href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=insight-data-82-release-notes\" rel=\"nofollow\"\u003erelease notes\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM SevOne Network Performance Management (NMS)\u003c/td\u003e\u003ctd\u003e8.2.3\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management\u0026amp;fixids=8.2.0-IBM-SevOne-NMS_8.2.3\u0026amp;source=dbluesearch\u0026amp;function=fixId\u0026amp;parent=ibm/Other%20software\" rel=\"noopener noreferrer nofollow\"\u003eDownload\u003c/a\u003e and refer to the \u003ca href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=nms-82-release-notes\" rel=\"noopener noreferrer nofollow\"\u003erelease notes\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM SevOne Network Performance Management (SD-WAN)\u003c/td\u003e\u003ctd\u003e8.2.3\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management\u0026amp;fixids=8.2.0-IBM-SevOne-SDWAN_8.2.3\u0026amp;source=SAR\u0026amp;function=fixId\u0026amp;parent=ibm/Other%20software\" rel=\"noopener noreferrer nofollow\"\u003eDownload\u003c/a\u003e and refer to the \u003ca href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=wan-sd-82-release-notes\" rel=\"noopener noreferrer nofollow\"\u003erelease notes\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/figure\u003e\u003c/div\u003e"
}
],
"value": "IBM SevOne Network Performance Management has previously remediated the vulnerabilities listed in this bulletin through product maintenance and updates.\u00a0\n\nThis security bulletin is being published as a historical reference to align with current security disclosure practices and does not contain new findings.\n\n\n\nIBM strongly recommends addressing these vulnerabilities now by upgrading. Please refer to the instructions below for installation steps for your specific version.\n\nProduct(s)\n\nLatest Version(s)\u00a0\n\nRemediation/Fix/InstructionsIBM SevOne Network Performance Management (DI)8.2.4 Download https://www.ibm.com/support/fixcentral/quickorder and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0 IBM SevOne Network Performance Management (NMS)8.2.3 Download https://www.ibm.com/support/fixcentral/swg/selectFixes and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0 IBM SevOne Network Performance Management (SD-WAN)8.2.3 Download https://www.ibm.com/support/fixcentral/swg/selectFixes and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0"
}
],
"title": "Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-95867",
"datePublished": "2026-11-08T19:44:13.593Z",
"dateReserved": "2026-09-22T17:02:58.971Z",
"dateUpdated": "2026-11-09T01:21:10.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17427 (GCVE-0-2026-17427)
Vulnerability from cvelistv5 – Published: 2026-11-08 19:15 – Updated: 2026-11-09 20:06
VLAI
EPSS
VEX
Title
This Power System update is being released to address
Summary
IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper validation of input length.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:06 UTC
CWE
- CWE-617 - Reachable Assertion
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7294278 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | OPENBMC |
Affected:
FW1060.00 , ≤ FW1060.81
(semver)
Affected: OP940.00 , ≤ OP940.A2 (semver) Affected: OP910.00 , ≤ OP910.95 (semver) cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.a2:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.a2.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.95:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.95.0:*:*:*:*:*:*:* |
|
| IBM | Power Hardware Management Console |
Affected:
OP940.00 , ≤ OP940.82
(semver)
cpe:2.3:a:ibm:power_hardware_management_console:op940.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:power_hardware_management_console:op940.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:power_hardware_management_console:op940.82:*:*:*:*:*:*:* cpe:2.3:a:ibm:power_hardware_management_console:op940.82.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17427",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:06:17.450788Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:06:28.219Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.a2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.a2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.95:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.95.0:*:*:*:*:*:*:*"
],
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1060.81",
"status": "affected",
"version": "FW1060.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "OP940.A2",
"status": "affected",
"version": "OP940.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "OP910.95",
"status": "affected",
"version": "OP910.00",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:power_hardware_management_console:op940.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:power_hardware_management_console:op940.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:power_hardware_management_console:op940.82:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:power_hardware_management_console:op940.82.0:*:*:*:*:*:*:*"
],
"product": "Power Hardware Management Console",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "OP940.82",
"status": "affected",
"version": "OP940.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper validation of input length.\u003c/p\u003e"
}
],
"value": "IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper validation of input length."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617 Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T19:15:50.339Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7294278"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers with the products below should install FW1060.82(1060_199) or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003ePower 10\u003cbr/\u003e1) IBM Power System S1022 (9105-22A)\u003cbr/\u003e2) IBM Power System S1024 (9105-42A)\u003cbr/\u003e3) IBM Power System S1022s (9105-22B)\u003cbr/\u003e4) IBM Power System S1014 (9105-41B)\u003cbr/\u003e5) IBM Power System L1022 (9786-22H)\u003cbr/\u003e6) IBM Power System L1024 (9786-42H)\u003cbr/\u003e7) IBM Power System E1050 (9043-MRX)\u003cbr/\u003e8) IBM Power System S1012 (9028-21B)\u003c/p\u003e\u003cp\u003eCustomers with the products below should install OP940.A3, OP910.96 or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003eOpenPower 9\u003cbr/\u003e1) IBM Power System AC922 (8335-GTG)\u003cbr/\u003e2) IBM Power System AC922 (8335-GTC, 8335-GTW)\u003cbr/\u003e3) IBM Power System AC922 (8335-GTH, 8335-GTX)\u003c/p\u003e\u003cp\u003eCustomers with the products below should install OP940.83 or newer to remediate this vulnerability.\u003cbr/\u003e1) IBM Power Hardware Management Console (7063-CR2)\u003c/p\u003e\u003cp\u003eThe images mentioned above can be located at IBM Fix Central :\u00a0\u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Customers with the products below should install FW1060.82(1060_199) or newer to remediate this vulnerability.\n\n\n\nPower 10\n1) IBM Power System S1022 (9105-22A)\n2) IBM Power System S1024 (9105-42A)\n3) IBM Power System S1022s (9105-22B)\n4) IBM Power System S1014 (9105-41B)\n5) IBM Power System L1022 (9786-22H)\n6) IBM Power System L1024 (9786-42H)\n7) IBM Power System E1050 (9043-MRX)\n8) IBM Power System S1012 (9028-21B)\n\n\n\nCustomers with the products below should install OP940.A3, OP910.96 or newer to remediate this vulnerability.\n\n\n\nOpenPower 9\n1) IBM Power System AC922 (8335-GTG)\n2) IBM Power System AC922 (8335-GTC, 8335-GTW)\n3) IBM Power System AC922 (8335-GTH, 8335-GTX)\n\n\n\nCustomers with the products below should install OP940.83 or newer to remediate this vulnerability.\n1) IBM Power Hardware Management Console (7063-CR2)\n\n\n\nThe images mentioned above can be located at IBM Fix Central :\u00a0 https://www.ibm.com/support/fixcentral/"
}
],
"title": "This Power System update is being released to address",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProtect access to the BMC\u0027s network interface by operating it on a private network or behind a firewall.\u003c/p\u003e"
}
],
"value": "Protect access to the BMC\u0027s network interface by operating it on a private network or behind a firewall."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-17427",
"datePublished": "2026-11-08T19:15:50.339Z",
"dateReserved": "2026-07-25T06:12:30.417Z",
"dateUpdated": "2026-11-09T20:06:28.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-17426 (GCVE-0-2026-17426)
Vulnerability from cvelistv5 – Published: 2026-11-08 19:15 – Updated: 2026-11-09 14:29
VLAI
EPSS
VEX
Title
This Power System update is being released to address
Summary
IBM Power Systems Firmware FW1060.00 through FW1060.81 could allow a remote attacker to cause a denial of service due to an unhandled exception.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:29 UTC
CWE
- CWE-248 - Uncaught Exception
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7291689 | vendor-advisorypatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-17426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:29:06.791670Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:29:17.092Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:*"
],
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1060.81",
"status": "affected",
"version": "FW1060.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Power Systems Firmware FW1060.00 through FW1060.81 could allow a remote attacker to cause a denial of service due to an unhandled exception.\u003c/p\u003e"
}
],
"value": "IBM Power Systems Firmware FW1060.00 through FW1060.81 could allow a remote attacker to cause a denial of service due to an unhandled exception."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T19:15:22.602Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7291689"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers with the products below should install FW1060.82(1060_195) or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003ePower 10\u003cbr/\u003e1) IBM Power System S1022 (9105-22A)\u003cbr/\u003e2) IBM Power System S1024 (9105-42A)\u003cbr/\u003e3) IBM Power System S1022s (9105-22B)\u003cbr/\u003e4) IBM Power System S1014 (9105-41B)\u003cbr/\u003e5) IBM Power System L1022 (9786-22H)\u003cbr/\u003e6) IBM Power System L1024 (9786-42H)\u003cbr/\u003e7) IBM Power System E1050 (9043-MRX)\u003cbr/\u003e8) IBM Power System S1012 (9028-21B)\u003c/p\u003e\u003cp\u003eThe images mentioned above can be located at IBM Fix Central : \u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Customers with the products below should install FW1060.82(1060_195) or newer to remediate this vulnerability.\n\n\n\nPower 10\n1) IBM Power System S1022 (9105-22A)\n2) IBM Power System S1024 (9105-42A)\n3) IBM Power System S1022s (9105-22B)\n4) IBM Power System S1014 (9105-41B)\n5) IBM Power System L1022 (9786-22H)\n6) IBM Power System L1024 (9786-42H)\n7) IBM Power System E1050 (9043-MRX)\n8) IBM Power System S1012 (9028-21B)\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/"
}
],
"title": "This Power System update is being released to address",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProtect access to the BMC\u0027s network interface by operating it on a private network or behind a firewall.\u003c/p\u003e"
}
],
"value": "Protect access to the BMC\u0027s network interface by operating it on a private network or behind a firewall."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-17426",
"datePublished": "2026-11-08T19:15:22.602Z",
"dateReserved": "2026-07-25T06:10:33.753Z",
"dateUpdated": "2026-11-09T14:29:17.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16697 (GCVE-0-2026-16697)
Vulnerability from cvelistv5 – Published: 2026-11-08 19:15 – Updated: 2026-11-08 19:15
VLAI
EPSS
VEX
Title
This Power System update is being released to address
Summary
IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper restriction of excessive computational resources.
Severity
6.5 (Medium)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7294277 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | OPENBMC |
Affected:
FW1060.00 , ≤ FW1060.81
(semver)
Affected: OP940.00 , ≤ OP940.A2 (semver) Affected: OP910.00 , ≤ OP910.95 (semver) cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.a2:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.a2.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.95:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.95.0:*:*:*:*:*:*:* |
|
| IBM | Power Hardware Management Console |
Affected:
OP940.00 , ≤ OP940.82
(semver)
cpe:2.3:a:ibm:power_hardware_management_console:op940.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:power_hardware_management_console:op940.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:power_hardware_management_console:op940.82:*:*:*:*:*:*:* cpe:2.3:a:ibm:power_hardware_management_console:op940.82.0:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.a2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.a2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.95:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.95.0:*:*:*:*:*:*:*"
],
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1060.81",
"status": "affected",
"version": "FW1060.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "OP940.A2",
"status": "affected",
"version": "OP940.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "OP910.95",
"status": "affected",
"version": "OP910.00",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:power_hardware_management_console:op940.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:power_hardware_management_console:op940.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:power_hardware_management_console:op940.82:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:power_hardware_management_console:op940.82.0:*:*:*:*:*:*:*"
],
"product": "Power Hardware Management Console",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "OP940.82",
"status": "affected",
"version": "OP940.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and\u0026nbsp; OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper restriction of excessive computational resources.\u003c/p\u003e"
}
],
"value": "IBM Power Systems Firmware FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and\u00a0 OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper restriction of excessive computational resources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T19:15:04.520Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7294277"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers with the products below should install FW1060.82(1060_199) or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003ePower 10\u003cbr/\u003e1) IBM Power System S1022 (9105-22A)\u003cbr/\u003e2) IBM Power System S1024 (9105-42A)\u003cbr/\u003e3) IBM Power System S1022s (9105-22B)\u003cbr/\u003e4) IBM Power System S1014 (9105-41B)\u003cbr/\u003e5) IBM Power System L1022 (9786-22H)\u003cbr/\u003e6) IBM Power System L1024 (9786-42H)\u003cbr/\u003e7) IBM Power System E1050 (9043-MRX)\u003cbr/\u003e8) IBM Power System S1012 (9028-21B)\u003c/p\u003e\u003cp\u003eCustomers with the products below should install OP940.A3, OP910.96 or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003eOpenPower 9\u003cbr/\u003e1) IBM Power System AC922 (8335-GTG)\u003cbr/\u003e2) IBM Power System AC922 (8335-GTC, 8335-GTW)\u003cbr/\u003e3) IBM Power System AC922 (8335-GTH, 8335-GTX)\u003c/p\u003e\u003cp\u003eCustomers with the products below should install OP940.83 or newer to remediate this vulnerability.\u003cbr/\u003e1) IBM Power Hardware Management Console (7063-CR2)\u003c/p\u003e\u003cp\u003eThe images mentioned above can be located at IBM Fix Central :\u00a0\u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Customers with the products below should install FW1060.82(1060_199) or newer to remediate this vulnerability.\n\n\n\nPower 10\n1) IBM Power System S1022 (9105-22A)\n2) IBM Power System S1024 (9105-42A)\n3) IBM Power System S1022s (9105-22B)\n4) IBM Power System S1014 (9105-41B)\n5) IBM Power System L1022 (9786-22H)\n6) IBM Power System L1024 (9786-42H)\n7) IBM Power System E1050 (9043-MRX)\n8) IBM Power System S1012 (9028-21B)\n\n\n\nCustomers with the products below should install OP940.A3, OP910.96 or newer to remediate this vulnerability.\n\n\n\nOpenPower 9\n1) IBM Power System AC922 (8335-GTG)\n2) IBM Power System AC922 (8335-GTC, 8335-GTW)\n3) IBM Power System AC922 (8335-GTH, 8335-GTX)\n\n\n\nCustomers with the products below should install OP940.83 or newer to remediate this vulnerability.\n1) IBM Power Hardware Management Console (7063-CR2)\n\n\n\nThe images mentioned above can be located at IBM Fix Central :\u00a0 https://www.ibm.com/support/fixcentral/"
}
],
"title": "This Power System update is being released to address",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProtect access to the BMC\u0027s network interface by operating it on a private network or behind a firewall.\u003c/p\u003e"
}
],
"value": "Protect access to the BMC\u0027s network interface by operating it on a private network or behind a firewall."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-16697",
"datePublished": "2026-11-08T19:15:04.520Z",
"dateReserved": "2026-07-23T01:20:20.167Z",
"dateUpdated": "2026-11-08T19:15:04.520Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16682 (GCVE-0-2026-16682)
Vulnerability from cvelistv5 – Published: 2026-11-08 19:14 – Updated: 2026-11-09 20:04
VLAI
EPSS
VEX
Title
This Power System update is being released to address
Summary
IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper handling of uninitialized resources.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:04 UTC
CWE
- CWE-908 - Use of Uninitialized Resource
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7294279 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | OPENBMC |
Affected:
FW1120.00 , ≤ FW1120.01
(semver)
Affected: FW1110.00 , ≤ FW1110.31 (semver) Affected: FW1060.00 , ≤ FW1060.81 (semver) Affected: OP940.00 , ≤ OP940.A2 (semver) Affected: OP910.00 , ≤ OP910.95 (semver) cpe:2.3:a:ibm:openbmc:fw1120.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1120.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1120.01:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1120.01.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.31:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1110.31.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.a2:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op940.a2.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.95:*:*:*:*:*:*:* cpe:2.3:a:ibm:openbmc:op910.95.0:*:*:*:*:*:*:* |
|
| IBM | Hardware Management Console |
Affected:
OP940.00 , ≤ OP940.82
(semver)
cpe:2.3:a:ibm:hardware_management_console:op940.00:*:*:*:*:*:*:* cpe:2.3:a:ibm:hardware_management_console:op940.00.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:hardware_management_console:op940.82:*:*:*:*:*:*:* cpe:2.3:a:ibm:hardware_management_console:op940.82.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16682",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:04:48.124929Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:04:59.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:openbmc:fw1120.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1120.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1120.01:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1120.01.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.31:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1110.31.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.a2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op940.a2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.95:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:openbmc:op910.95.0:*:*:*:*:*:*:*"
],
"product": "OPENBMC",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "FW1120.01",
"status": "affected",
"version": "FW1120.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW1110.31",
"status": "affected",
"version": "FW1110.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "FW1060.81",
"status": "affected",
"version": "FW1060.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "OP940.A2",
"status": "affected",
"version": "OP940.00",
"versionType": "semver"
},
{
"lessThanOrEqual": "OP910.95",
"status": "affected",
"version": "OP910.00",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:hardware_management_console:op940.00:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hardware_management_console:op940.00.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hardware_management_console:op940.82:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hardware_management_console:op940.82.0:*:*:*:*:*:*:*"
],
"product": "Hardware Management Console",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "OP940.82",
"status": "affected",
"version": "OP940.00",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper handling of uninitialized resources.\u003c/p\u003e"
}
],
"value": "IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 could allow a remote attacker to cause a denial of service due to improper handling of uninitialized resources."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-908",
"description": "CWE-908 Use of Uninitialized Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T19:14:32.625Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7294279"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCustomers with the products below should install FW1120.02(1120_195), FW1110.32(1110_160) or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003ePower 11\u003cbr/\u003e1) IBM Power System S1122 (9824-22A)\u003cbr/\u003e2) IBM Power System S1124 (9824-42A)\u003cbr/\u003e3) IBM Power System S1122s (9824-22B)\u003cbr/\u003e4) IBM Power System S1114 (9824-41B)\u003cbr/\u003e5) IBM Power System L1122 (9856-22H)\u003cbr/\u003e6) IBM Power System L1124 (9856-42H)\u003cbr/\u003e7) IBM Power System E1150 (9043-MRU)\u003cbr/\u003e8) IBM Power System S1112 (9242-21B, 9242-21T)\u003c/p\u003e\u003cp\u003eCustomers with the products below should install FW1060.82(1060_199) or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003ePower 10\u003cbr/\u003e1) IBM Power System S1022 (9105-22A)\u003cbr/\u003e2) IBM Power System S1024 (9105-42A)\u003cbr/\u003e3) IBM Power System S1022s (9105-22B)\u003cbr/\u003e4) IBM Power System S1014 (9105-41B)\u003cbr/\u003e5) IBM Power System L1022 (9786-22H)\u003cbr/\u003e6) IBM Power System L1024 (9786-42H)\u003cbr/\u003e7) IBM Power System E1050 (9043-MRX)\u003cbr/\u003e8) IBM Power System S1012 (9028-21B)\u003c/p\u003e\u003cp\u003eCustomers with the products below should install OP940.A3, OP910.96 or newer to remediate this vulnerability.\u003c/p\u003e\u003cp\u003eOpenPower 9\u003cbr/\u003e1) IBM Power System AC922 (8335-GTG)\u003cbr/\u003e2) IBM Power System AC922 (8335-GTC, 8335-GTW)\u003cbr/\u003e3) IBM Power System AC922 (8335-GTH, 8335-GTX)\u003c/p\u003e\u003cp\u003eCustomers with the products below should install OP940.83 or newer to remediate this vulnerability.\u003cbr/\u003e1) IBM Power Hardware Management Console (7063-CR2)\u003c/p\u003e\u003cp\u003eThe images mentioned above can be located at IBM Fix Central :\u00a0\u003ca href=\"https://www.ibm.com/support/fixcentral/\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "Customers with the products below should install FW1120.02(1120_195), FW1110.32(1110_160) or newer to remediate this vulnerability.\n\n\n\nPower 11\n1) IBM Power System S1122 (9824-22A)\n2) IBM Power System S1124 (9824-42A)\n3) IBM Power System S1122s (9824-22B)\n4) IBM Power System S1114 (9824-41B)\n5) IBM Power System L1122 (9856-22H)\n6) IBM Power System L1124 (9856-42H)\n7) IBM Power System E1150 (9043-MRU)\n8) IBM Power System S1112 (9242-21B, 9242-21T)\n\n\n\nCustomers with the products below should install FW1060.82(1060_199) or newer to remediate this vulnerability.\n\n\n\nPower 10\n1) IBM Power System S1022 (9105-22A)\n2) IBM Power System S1024 (9105-42A)\n3) IBM Power System S1022s (9105-22B)\n4) IBM Power System S1014 (9105-41B)\n5) IBM Power System L1022 (9786-22H)\n6) IBM Power System L1024 (9786-42H)\n7) IBM Power System E1050 (9043-MRX)\n8) IBM Power System S1012 (9028-21B)\n\n\n\nCustomers with the products below should install OP940.A3, OP910.96 or newer to remediate this vulnerability.\n\n\n\nOpenPower 9\n1) IBM Power System AC922 (8335-GTG)\n2) IBM Power System AC922 (8335-GTC, 8335-GTW)\n3) IBM Power System AC922 (8335-GTH, 8335-GTX)\n\n\n\nCustomers with the products below should install OP940.83 or newer to remediate this vulnerability.\n1) IBM Power Hardware Management Console (7063-CR2)\n\n\n\nThe images mentioned above can be located at IBM Fix Central :\u00a0 https://www.ibm.com/support/fixcentral/"
}
],
"title": "This Power System update is being released to address",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProtect access to the BMC\u0027s network interface by operating it on a private network or behind a firewall.\u003c/p\u003e"
}
],
"value": "Protect access to the BMC\u0027s network interface by operating it on a private network or behind a firewall."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-16682",
"datePublished": "2026-11-08T19:14:32.625Z",
"dateReserved": "2026-07-22T20:43:13.874Z",
"dateUpdated": "2026-11-09T20:04:59.484Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97677 (GCVE-0-2026-97677)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:49 – Updated: 2026-11-09 20:08
VLAI
EPSS
VEX
Title
Langflow OSS is affected by multiple vulnerabilities
Summary
IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the contents of arbitrary files accessible to the service process — including configuration files, secrets, or database files stored under the application's data directory.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:08 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7290694 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Langflow OSS |
Affected:
1.0.0 , ≤ 1.12.2
(semver)
cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-97677",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:08:33.083534Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:08:43.170Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:langflow_oss:1.12.2:*:*:*:*:*:*:*"
],
"product": "Langflow OSS",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "1.12.2",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform\u0027s local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the contents of arbitrary files accessible to the service process \u2014 including configuration files, secrets, or database files stored under the application\u0027s data directory.\u003c/p\u003e"
}
],
"value": "IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform\u0027s local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the contents of arbitrary files accessible to the service process \u2014 including configuration files, secrets, or database files stored under the application\u0027s data directory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:49:21.372Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7290694"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading \u003ca href=\"https://pypi.org/project/langflow/#description\" rel=\"nofollow\"\u003eLangflow OSS to version 1.12.3.\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.12.3. https://pypi.org/project/langflow/#description"
}
],
"title": "Langflow OSS is affected by multiple vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-97677",
"datePublished": "2026-11-08T18:49:21.372Z",
"dateReserved": "2026-09-24T20:47:33.186Z",
"dateUpdated": "2026-11-09T20:08:43.170Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-9764 (GCVE-0-2026-9764)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:48 – Updated: 2026-11-09 21:12
VLAI
EPSS
VEX
Title
IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution
Summary
IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 21:12 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7291535 | vendor-advisorypatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-9764",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T21:12:48.063108Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:12:56.521Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:bob:1.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:bob:2.0.1:*:*:*:*:*:*:*"
],
"product": "Bob Shell",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "2.0.1",
"status": "affected",
"version": "1.0.4",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.\u003c/p\u003e"
}
],
"value": "IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:49:02.573Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7291535"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to \u003ca href=\"https://bob.ibm.com/docs/shell\" rel=\"nofollow\"\u003eIBM Bob Shell V 2.0.2 or the later\u003c/a\u003e.\u003c/p\u003e\u003cp\u003eWe recommend reviewing the documentation for guidance on installing\u00a0\u003ca href=\"https://bob.ibm.com/docs/ide/getting-started/install\" rel=\"nofollow\"\u003eIBM Bob\u003c/a\u003e.\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading to IBM Bob Shell V 2.0.2 or the later https://bob.ibm.com/docs/shell .\n\n\n\nWe recommend reviewing the documentation for guidance on installing\u00a0 IBM Bob https://bob.ibm.com/docs/ide/getting-started/install ."
}
],
"title": "IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eUntil an upgrade can be applied, IBM recommends the following precautions:\u003c/p\u003e\u003cdiv\u003eOnly use IBM Bob Shell with trusted repositories and trusted code sources.\u003c/div\u003e\u003cdiv\u003eAvoid opening repositories obtained from unknown or untrusted parties.\u003c/div\u003e\u003cdiv\u003eReview repository contents and configuration before use in shared or public environments.\u003c/div\u003e\u003cdiv\u003eFollow organizational security practices for validating and approving source code repositories.\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003eNote: These mitigations reduce exposure but do not fully address the vulnerability. IBM recommends upgrading to IBM Bob Shell version 2.0.2 or later as the preferred remediation.\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Until an upgrade can be applied, IBM recommends the following precautions:\n\nOnly use IBM Bob Shell with trusted repositories and trusted code sources.\n\nAvoid opening repositories obtained from unknown or untrusted parties.\n\nReview repository contents and configuration before use in shared or public environments.\n\nFollow organizational security practices for validating and approving source code repositories.\n\n\n\nNote: These mitigations reduce exposure but do not fully address the vulnerability. IBM recommends upgrading to IBM Bob Shell version 2.0.2 or later as the preferred remediation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-9764",
"datePublished": "2026-11-08T18:48:35.920Z",
"dateReserved": "2026-05-27T18:55:55.317Z",
"dateUpdated": "2026-11-09T21:12:56.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93879 (GCVE-0-2026-93879)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:47 – Updated: 2026-11-09 14:10
VLAI
EPSS
VEX
Title
Hibernate Validator is affected by an expression language injection vulnerability
Summary
Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:10 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293301 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Hibernate Validator |
Affected:
5.4.1.Final , ≤ 6.2.5.Final
(semver)
Affected: 7.0.0.Alpha1 , ≤ 7.0.5.Final (semver) Affected: 8.0.0.Alpha1 , ≤ 8.0.5.Final (semver) Affected: 9.0.0.Beta2 , ≤ 9.0.1.Final (semver) Affected: 9.1.0.Alpha1 , ≤ 9.1.4.Final (semver) cpe:2.3:a:ibm:hibernate_validator:5.4.1.final:*:*:*:*:*:*:* cpe:2.3:a:ibm:hibernate_validator:6.2.5.final:*:*:*:*:*:*:* cpe:2.3:a:ibm:hibernate_validator:7.0.0.alpha1:*:*:*:*:*:*:* cpe:2.3:a:ibm:hibernate_validator:7.0.5.final:*:*:*:*:*:*:* cpe:2.3:a:ibm:hibernate_validator:8.0.0.alpha1:*:*:*:*:*:*:* cpe:2.3:a:ibm:hibernate_validator:8.0.5.final:*:*:*:*:*:*:* cpe:2.3:a:ibm:hibernate_validator:9.0.0.beta2:*:*:*:*:*:*:* cpe:2.3:a:ibm:hibernate_validator:9.0.1.final:*:*:*:*:*:*:* cpe:2.3:a:ibm:hibernate_validator:9.1.0.alpha1:*:*:*:*:*:*:* cpe:2.3:a:ibm:hibernate_validator:9.1.4.final:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-93879",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:10:28.896151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:10:37.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:hibernate_validator:5.4.1.final:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hibernate_validator:6.2.5.final:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hibernate_validator:7.0.0.alpha1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hibernate_validator:7.0.5.final:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hibernate_validator:8.0.0.alpha1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hibernate_validator:8.0.5.final:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hibernate_validator:9.0.0.beta2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hibernate_validator:9.0.1.final:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hibernate_validator:9.1.0.alpha1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:hibernate_validator:9.1.4.final:*:*:*:*:*:*:*"
],
"product": "Hibernate Validator",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "6.2.5.Final",
"status": "affected",
"version": "5.4.1.Final",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.5.Final",
"status": "affected",
"version": "7.0.0.Alpha1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.0.5.Final",
"status": "affected",
"version": "8.0.0.Alpha1",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.0.1.Final",
"status": "affected",
"version": "9.0.0.Beta2",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.1.4.Final",
"status": "affected",
"version": "9.1.0.Alpha1",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eHibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.\u003c/p\u003e"
}
],
"value": "Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:47:46.353Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293301"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIt is strongly recommended to address the vulnerability by upgrading to the latest version.\u003c/p\u003e\u003cp\u003eUpgrade to 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final or later.\u003c/p\u003e\u003cp\u003eFor more information see: \u003ca href=\"https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5\" rel=\"noreferrer noopener nofollow\"\u003ehttps://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "It is strongly recommended to address the vulnerability by upgrading to the latest version.\n\n\n\nUpgrade to 6.2.6.Final, 7.0.6.Final, 8.0.6.Final, 9.0.2.Final, 9.1.5.Final or later.\n\n\n\nFor more information see: https://github.com/hibernate/hibernate-validator/security/advisories/GHSA-gv36-fx3r-29p5"
}
],
"title": "Hibernate Validator is affected by an expression language injection vulnerability",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe safe alternative for custom validators is to use `addExpressionVariable` instead of `addMessageParameter` when injecting user-controlled values into EL-enabled messages, as expression variables are bound as typed objects and are never re-parsed as EL expressions.\u003c/p\u003e"
}
],
"value": "The safe alternative for custom validators is to use `addExpressionVariable` instead of `addMessageParameter` when injecting user-controlled values into EL-enabled messages, as expression variables are bound as typed objects and are never re-parsed as EL expressions."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-93879",
"datePublished": "2026-11-08T18:47:46.353Z",
"dateReserved": "2026-09-18T20:04:20.857Z",
"dateUpdated": "2026-11-09T14:10:37.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93005 (GCVE-0-2026-93005)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:46 – Updated: 2026-11-08 18:46
VLAI
EPSS
VEX
Title
Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026
Summary
IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients.
Severity
6.5 (Medium)
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7294875 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Process Mining |
Affected:
2.0.0 , ≤ 2.2.1
(semver)
cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"
],
"product": "Process Mining",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "2.2.1",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients.\u003c/p\u003e"
}
],
"value": "IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:46:24.333Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7294875"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003eVersion(s) number and/or range\u00a0\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Process Mining OCP\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cp\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\u003cbr/\u003e\u003cbr/\u003eUpgrade to version 2.2.1 IF001\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003euniIBM Process Mining On-Prem\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cdiv\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\u003cbr/\u003e\u003cbr/\u003eSteps\u003cbr/\u003e1. Go to IBM Support Portal\u003cbr/\u003eNavigate to \u003ca href=\"https://ibm.com/mysupport\" rel=\"nofollow\"\u003ehttps://ibm.com/mysupport\u003c/a\u003e and sign in with your IBMid before proceeding.\u003cbr/\u003e2. Open a case\u003c/div\u003e\u003cul\u003e\u003cli\u003eClick \"Open a case\" from the support portal.\u003c/li\u003e\u003cli\u003eSelect IBM Process Mining as the product.\u003c/li\u003e\u003cli\u003eFill in the case details, referencing the published security advisory: \u003ca href=\"https://www.ibm.com/support/pages/node/7294875\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7294875\u003c/a\u003e\u003c/li\u003e\u003cli\u003eRequest the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e3. Obtain the fix\u003cbr/\u003eThe interim fix will be delivered directly through your support case once it has been opened.\u003c/div\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "Product(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM Process Mining OCP2.0.0 - 2.2.1\n\nIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\n\nUpgrade to version 2.2.1 IF001\n https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001 \n\n\n\n\n\nuniIBM Process Mining On-Prem2.0.0 - 2.2.1IBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\n\nSteps\n1. Go to IBM Support Portal\nNavigate to https://ibm.com/mysupport and sign in with your IBMid before proceeding.\n2. Open a case\n\n * Click \"Open a case\" from the support portal.\n * Select IBM Process Mining as the product.\n * Fill in the case details, referencing the published security advisory: https://www.ibm.com/support/pages/node/7294875 \n * Request the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\n\n\n3. Obtain the fix\nThe interim fix will be delivered directly through your support case once it has been opened."
}
],
"title": "Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-93005",
"datePublished": "2026-11-08T18:46:24.333Z",
"dateReserved": "2026-09-17T14:31:27.823Z",
"dateUpdated": "2026-11-08T18:46:24.333Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8860 (GCVE-0-2026-8860)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:46 – Updated: 2026-11-09 19:27
VLAI
EPSS
VEX
Title
IBM Verify Directory is affected by multiple vulnerabilities
Summary
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 19:26 UTC
CWE
- CWE-650 - Trusting HTTP Permission Methods on the Server Side
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293828 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Security Verify Directory |
Affected:
10.0.0 , ≤ 10.0.4
(semver)
cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:* |
|
| IBM | Verify Directory |
Affected:
11.0.0
cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T19:26:36.414420Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:27:19.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*"
],
"product": "Security Verify Directory",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "10.0.4",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:*"
],
"product": "Verify Directory",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "11.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs.\u003c/p\u003e"
}
],
"value": "IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parameters. This causes passwords to be exposed in browser history and server logs."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-650",
"description": "CWE-650 Trusting HTTP Permission Methods on the Server Side",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:46:12.242Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293828"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eIBM strongly encourages customers to update their systems promptly.\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAffected Version(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFix\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Security Verify Directory\u003c/td\u003e\u003ctd\u003e10.0.0-10.0.4\u003c/td\u003e\u003ctd\u003eDownload and install IBM Security Verify Directory v10.0.4.4\u003cbr/\u003eDownload document - \u003ca href=\"https://www.ibm.com/support/pages/node/7292855\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7292855\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Verify Directory\u003c/td\u003e\u003ctd\u003e11.0.0\u003c/td\u003e\u003ctd\u003eDownload and install IBM Verify Directory v11.0.1.2\u003cbr/\u003eDownload document - \u003ca href=\"https://www.ibm.com/support/pages/node/7290214\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7290214\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\n\n\nProduct(s)Affected Version(s)FixIBM Security Verify Directory10.0.0-10.0.4Download and install IBM Security Verify Directory v10.0.4.4\nDownload document - https://www.ibm.com/support/pages/node/7292855 IBM Verify Directory11.0.0Download and install IBM Verify Directory v11.0.1.2\nDownload document - https://www.ibm.com/support/pages/node/7290214"
}
],
"title": "IBM Verify Directory is affected by multiple vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-8860",
"datePublished": "2026-11-08T18:46:12.242Z",
"dateReserved": "2026-05-18T18:33:40.319Z",
"dateUpdated": "2026-11-09T19:27:19.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8642 (GCVE-0-2026-8642)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:45 – Updated: 2026-11-09 19:05
VLAI
EPSS
VEX
Title
IBM Verify Directory is affected by multiple vulnerabilities
Summary
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 19:05 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293828 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Security Verify Directory |
Affected:
10.0.0 , ≤ 10.0.4
(semver)
cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:* |
|
| IBM | Verify Directory |
Affected:
11.0.0
cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8642",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T19:05:02.941507Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:05:12.605Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*"
],
"product": "Security Verify Directory",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "10.0.4",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:*"
],
"product": "Verify Directory",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "11.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions.\u003c/p\u003e"
}
],
"value": "IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:45:20.654Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293828"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eIBM strongly encourages customers to update their systems promptly.\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAffected Version(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFix\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Security Verify Directory\u003c/td\u003e\u003ctd\u003e10.0.0-10.0.4\u003c/td\u003e\u003ctd\u003eDownload and install IBM Security Verify Directory v10.0.4.4\u003cbr/\u003eDownload document - \u003ca href=\"https://www.ibm.com/support/pages/node/7292855\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7292855\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Verify Directory\u003c/td\u003e\u003ctd\u003e11.0.0\u003c/td\u003e\u003ctd\u003eDownload and install IBM Verify Directory v11.0.1.2\u003cbr/\u003eDownload document - \u003ca href=\"https://www.ibm.com/support/pages/node/7290214\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7290214\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\n\n\nProduct(s)Affected Version(s)FixIBM Security Verify Directory10.0.0-10.0.4Download and install IBM Security Verify Directory v10.0.4.4\nDownload document - https://www.ibm.com/support/pages/node/7292855 IBM Verify Directory11.0.0Download and install IBM Verify Directory v11.0.1.2\nDownload document - https://www.ibm.com/support/pages/node/7290214"
}
],
"title": "IBM Verify Directory is affected by multiple vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-8642",
"datePublished": "2026-11-08T18:45:20.654Z",
"dateReserved": "2026-05-14T20:02:22.497Z",
"dateUpdated": "2026-11-09T19:05:12.605Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8640 (GCVE-0-2026-8640)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:45 – Updated: 2026-11-09 19:07
VLAI
EPSS
VEX
Title
IBM Verify Directory is affected by multiple vulnerabilities
Summary
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users' browsers to send unauthorized requests to the application.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 19:06 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293828 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Security Verify Directory |
Affected:
10.0.0 , ≤ 10.0.4
(semver)
cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:* |
|
| IBM | Verify Directory |
Affected:
11.0.0
cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8640",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T19:06:53.632042Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:07:05.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*"
],
"product": "Security Verify Directory",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "10.0.4",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:*"
],
"product": "Verify Directory",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "11.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users\u0027 browsers to send unauthorized requests to the application.\u003c/p\u003e"
}
],
"value": "IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can cause authenticated users\u0027 browsers to send unauthorized requests to the application."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:45:03.843Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293828"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eIBM strongly encourages customers to update their systems promptly.\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAffected Version(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFix\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Security Verify Directory\u003c/td\u003e\u003ctd\u003e10.0.0-10.0.4\u003c/td\u003e\u003ctd\u003eDownload and install IBM Security Verify Directory v10.0.4.4\u003cbr/\u003eDownload document - \u003ca href=\"https://www.ibm.com/support/pages/node/7292855\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7292855\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Verify Directory\u003c/td\u003e\u003ctd\u003e11.0.0\u003c/td\u003e\u003ctd\u003eDownload and install IBM Verify Directory v11.0.1.2\u003cbr/\u003eDownload document - \u003ca href=\"https://www.ibm.com/support/pages/node/7290214\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7290214\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\n\n\nProduct(s)Affected Version(s)FixIBM Security Verify Directory10.0.0-10.0.4Download and install IBM Security Verify Directory v10.0.4.4\nDownload document - https://www.ibm.com/support/pages/node/7292855 IBM Verify Directory11.0.0Download and install IBM Verify Directory v11.0.1.2\nDownload document - https://www.ibm.com/support/pages/node/7290214"
}
],
"title": "IBM Verify Directory is affected by multiple vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-8640",
"datePublished": "2026-11-08T18:45:03.843Z",
"dateReserved": "2026-05-14T19:54:11.156Z",
"dateUpdated": "2026-11-09T19:07:05.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8639 (GCVE-0-2026-8639)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:44 – Updated: 2026-11-09 04:55
VLAI
EPSS
VEX
Title
IBM Verify Directory is affected by multiple vulnerabilities
Summary
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-08 00:00 UTC
CWE
- CWE-384 - Session Fixation
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293828 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Security Verify Directory |
Affected:
10.0.0 , ≤ 10.0.4
(semver)
cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:security_verify_directory:10.0.4:*:*:*:*:*:*:* |
|
| IBM | Verify Directory |
Affected:
11.0.0
cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8639",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T04:55:32.154Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:security_verify_directory:10.0.4:*:*:*:*:*:*:*"
],
"product": "Security Verify Directory",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "10.0.4",
"status": "affected",
"version": "10.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:verify_directory:11.0.0:*:*:*:*:*:*:*"
],
"product": "Verify Directory",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "11.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console.\u003c/p\u003e"
}
],
"value": "IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-384",
"description": "CWE-384 Session Fixation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:44:42.607Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293828"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eIBM strongly encourages customers to update their systems promptly.\u003c/strong\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eAffected Version(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eFix\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Security Verify Directory\u003c/td\u003e\u003ctd\u003e10.0.0-10.0.4\u003c/td\u003e\u003ctd\u003eDownload and install IBM Security Verify Directory v10.0.4.4\u003cbr/\u003eDownload document - \u003ca href=\"https://www.ibm.com/support/pages/node/7292855\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7292855\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Verify Directory\u003c/td\u003e\u003ctd\u003e11.0.0\u003c/td\u003e\u003ctd\u003eDownload and install IBM Verify Directory v11.0.1.2\u003cbr/\u003eDownload document - \u003ca href=\"https://www.ibm.com/support/pages/node/7290214\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7290214\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly encourages customers to update their systems promptly.\n\n\n\n\n\nProduct(s)Affected Version(s)FixIBM Security Verify Directory10.0.0-10.0.4Download and install IBM Security Verify Directory v10.0.4.4\nDownload document - https://www.ibm.com/support/pages/node/7292855 IBM Verify Directory11.0.0Download and install IBM Verify Directory v11.0.1.2\nDownload document - https://www.ibm.com/support/pages/node/7290214"
}
],
"title": "IBM Verify Directory is affected by multiple vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-8639",
"datePublished": "2026-11-08T18:44:42.607Z",
"dateReserved": "2026-05-14T19:51:20.707Z",
"dateUpdated": "2026-11-09T04:55:32.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84237 (GCVE-0-2026-84237)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:42 – Updated: 2026-11-08 18:42
VLAI
EPSS
VEX
Title
IBM Guardium Data Protection is affected by multiple vulnerabilities
Summary
IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
Severity
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7295791 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Guardium Data Protection |
Affected:
12.2.4
cpe:2.3:a:ibm:guardium_data_protection:12.2.4:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:guardium_data_protection:12.2.4:*:*:*:*:*:*:*"
],
"product": "Guardium Data Protection",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "12.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.\u003c/p\u003e"
}
],
"value": "IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:42:24.369Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7295791"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\u003cstrong\u003eIBM encourages customers to update their systems promptly.\u003c/strong\u003e\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Product\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersions\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Fix\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Data Protection\u003c/td\u003e\u003ctd\u003e12.2.4\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026amp;includeSupersedes=0\u0026amp;source=fc\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026amp;includeSupersedes=0\u0026amp;source=fc\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM encourages customers to update their systems promptly.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\u00a0ProductVersions\u00a0FixIBM Guardium Data Protection12.2.4 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026product=ibm/Information+Management/InfoSphere+Guardium\u0026release=All\u0026platform=All\u0026function=fixId\u0026fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026includeSupersedes=0\u0026source=fc"
}
],
"title": "IBM Guardium Data Protection is affected by multiple vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-84237",
"datePublished": "2026-11-08T18:42:24.369Z",
"dateReserved": "2026-09-01T13:02:57.209Z",
"dateUpdated": "2026-11-08T18:42:24.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84229 (GCVE-0-2026-84229)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:42 – Updated: 2026-11-09 20:18
VLAI
EPSS
VEX
Title
IBM Guardium Data Protection is affected by multiple vulnerabilities
Summary
IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:17 UTC
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7295791 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Guardium Data Protection |
Affected:
12.2.4
cpe:2.3:a:ibm:guardium_data_protection:12.2.4:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84229",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:17:52.583002Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:18:00.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:guardium_data_protection:12.2.4:*:*:*:*:*:*:*"
],
"product": "Guardium Data Protection",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "12.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests.\u003c/p\u003e"
}
],
"value": "IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:42:14.253Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7295791"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\u003cstrong\u003eIBM encourages customers to update their systems promptly.\u003c/strong\u003e\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Product\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersions\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Fix\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Data Protection\u003c/td\u003e\u003ctd\u003e12.2.4\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026amp;includeSupersedes=0\u0026amp;source=fc\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026amp;includeSupersedes=0\u0026amp;source=fc\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM encourages customers to update their systems promptly.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\u00a0ProductVersions\u00a0FixIBM Guardium Data Protection12.2.4 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026product=ibm/Information+Management/InfoSphere+Guardium\u0026release=All\u0026platform=All\u0026function=fixId\u0026fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026includeSupersedes=0\u0026source=fc"
}
],
"title": "IBM Guardium Data Protection is affected by multiple vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-84229",
"datePublished": "2026-11-08T18:42:14.253Z",
"dateReserved": "2026-09-01T12:04:06.199Z",
"dateUpdated": "2026-11-09T20:18:00.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84228 (GCVE-0-2026-84228)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:42 – Updated: 2026-11-09 20:10
VLAI
EPSS
VEX
Title
IBM Guardium Data Protection is affected by multiple vulnerabilities
Summary
IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:09 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7295791 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Guardium Data Protection |
Affected:
12.2.4
cpe:2.3:a:ibm:guardium_data_protection:12.2.4:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84228",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:09:40.726282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:10:02.654Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:guardium_data_protection:12.2.4:*:*:*:*:*:*:*"
],
"product": "Guardium Data Protection",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "12.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.\u003c/p\u003e"
}
],
"value": "IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:42:01.329Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7295791"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\u003cstrong\u003eIBM encourages customers to update their systems promptly.\u003c/strong\u003e\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Product\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersions\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Fix\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Data Protection\u003c/td\u003e\u003ctd\u003e12.2.4\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026amp;includeSupersedes=0\u0026amp;source=fc\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026amp;includeSupersedes=0\u0026amp;source=fc\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM encourages customers to update their systems promptly.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\u00a0ProductVersions\u00a0FixIBM Guardium Data Protection12.2.4 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026product=ibm/Information+Management/InfoSphere+Guardium\u0026release=All\u0026platform=All\u0026function=fixId\u0026fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026includeSupersedes=0\u0026source=fc"
}
],
"title": "IBM Guardium Data Protection is affected by multiple vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-84228",
"datePublished": "2026-11-08T18:42:01.329Z",
"dateReserved": "2026-09-01T12:03:07.697Z",
"dateUpdated": "2026-11-09T20:10:02.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84030 (GCVE-0-2026-84030)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:41 – Updated: 2026-11-09 20:17
VLAI
EPSS
VEX
Title
IBM Guardium Data Protection is affected by multiple vulnerabilities
Summary
IBM Guardium Data Protection 12.2.4 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.
Severity
5.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:16 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7295791 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Guardium Data Protection |
Affected:
12.2.4
cpe:2.3:a:ibm:guardium_data_protection:12.2.4:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84030",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:16:56.399411Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:17:05.329Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:guardium_data_protection:12.2.4:*:*:*:*:*:*:*"
],
"product": "Guardium Data Protection",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "12.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Guardium Data Protection 12.2.4 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.\u003c/p\u003e"
}
],
"value": "IBM Guardium Data Protection 12.2.4 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:41:47.851Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7295791"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\u003cstrong\u003eIBM encourages customers to update their systems promptly.\u003c/strong\u003e\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Product\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersions\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Fix\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Data Protection\u003c/td\u003e\u003ctd\u003e12.2.4\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026amp;includeSupersedes=0\u0026amp;source=fc\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026amp;includeSupersedes=0\u0026amp;source=fc\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM encourages customers to update their systems promptly.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\u00a0ProductVersions\u00a0FixIBM Guardium Data Protection12.2.4 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026product=ibm/Information+Management/InfoSphere+Guardium\u0026release=All\u0026platform=All\u0026function=fixId\u0026fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026includeSupersedes=0\u0026source=fc"
}
],
"title": "IBM Guardium Data Protection is affected by multiple vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-84030",
"datePublished": "2026-11-08T18:41:47.851Z",
"dateReserved": "2026-09-01T02:02:29.242Z",
"dateUpdated": "2026-11-09T20:17:05.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82830 (GCVE-0-2026-82830)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:41 – Updated: 2026-11-09 04:55
VLAI
EPSS
VEX
Title
IBM Guardium Data Protection is affected by multiple vulnerabilities
Summary
IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-08 00:00 UTC
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7295791 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Guardium Data Protection |
Affected:
12.2.4
cpe:2.3:a:ibm:guardium_data_protection:12.2.4:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-08T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T04:55:31.024Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:guardium_data_protection:12.2.4:*:*:*:*:*:*:*"
],
"product": "Guardium Data Protection",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "12.2.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters.\u003c/p\u003e"
}
],
"value": "IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:41:28.287Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7295791"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003e\u003cstrong\u003eIBM encourages customers to update their systems promptly.\u003c/strong\u003e\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Product\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersions\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003e\u00a0Fix\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Data Protection\u003c/td\u003e\u003ctd\u003e12.2.4\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026amp;includeSupersedes=0\u0026amp;source=fc\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026amp;product=ibm/Information+Management/InfoSphere+Guardium\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026amp;includeSupersedes=0\u0026amp;source=fc\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM encourages customers to update their systems promptly.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\u00a0ProductVersions\u00a0FixIBM Guardium Data Protection12.2.4 https://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security\u0026product=ibm/Information+Management/InfoSphere+Guardium\u0026release=All\u0026platform=All\u0026function=fixId\u0026fixids=SqlGuard_12.0p7240_GPU_Oct_2026_V12.2.4_FC\u0026includeSupersedes=0\u0026source=fc"
}
],
"title": "IBM Guardium Data Protection is affected by multiple vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-82830",
"datePublished": "2026-11-08T18:41:28.287Z",
"dateReserved": "2026-08-31T07:02:10.911Z",
"dateUpdated": "2026-11-09T04:55:31.024Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81542 (GCVE-0-2026-81542)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:41 – Updated: 2026-11-08 18:41
VLAI
EPSS
VEX
Title
DataStage on Cloud Pak for Data has several vulnerabilities
Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.
Severity
6.4 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7294270 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | DataStage on Cloud Pak for Data |
Affected:
5.4.0.0
cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"
],
"product": "DataStage on Cloud Pak for Data",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.4.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.\u003c/p\u003e"
}
],
"value": "IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:41:04.228Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7294270"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003eVersion(s) number and/or range\u00a0\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eDataStage on Cloud Pak for Data\u003c/td\u003e\u003ctd\u003e5.4.0.0\u003c/td\u003e\u003ctd\u003e\u003cp\u003eUpgrade to 5.4 patch 8 or later by following these \u003ca href=\"https://www.ibm.com/docs/en/software-hub/5.4.x?topic=overview-available-patches-software-hub-version-540\" rel=\"nofollow\"\u003einstructions\u003c/a\u003e.\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0\n\nUpgrade to 5.4 patch 8 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x ."
}
],
"title": "DataStage on Cloud Pak for Data has several vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-81542",
"datePublished": "2026-11-08T18:41:04.228Z",
"dateReserved": "2026-08-27T00:09:07.806Z",
"dateUpdated": "2026-11-08T18:41:04.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81209 (GCVE-0-2026-81209)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:40 – Updated: 2026-11-09 19:03
VLAI
EPSS
VEX
Title
Sensitive Information in Log files affects IBM Sterling B2B Integrator and IBM Sterling File Gateway
Summary
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to obtain sensitive information due to improper logging of sensitive credentials.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 19:03 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293291 | vendor-advisorypatch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Sterling B2B Integrator |
Affected:
6.2.1.0 , ≤ 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1
(semver)
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.2_1:*:*:*:*:*:*:* |
|
| IBM | Sterling File Gateway |
Affected:
6.2.1.0 , ≤ 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1
(semver)
cpe:2.3:a:ibm:sterling_file_gateway:6.2.1.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:sterling_file_gateway:6.2.1.2_1:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81209",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T19:03:31.336674Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:03:39.364Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.1.2_1:*:*:*:*:*:*:*"
],
"product": "Sterling B2B Integrator",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1",
"status": "affected",
"version": "6.2.1.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:ibm:sterling_file_gateway:6.2.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:sterling_file_gateway:6.2.1.2_1:*:*:*:*:*:*:*"
],
"product": "Sterling File Gateway",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1",
"status": "affected",
"version": "6.2.1.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to obtain sensitive information due to improper logging of sensitive credentials.\u003c/p\u003e"
}
],
"value": "IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to obtain sensitive information due to improper logging of sensitive credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:40:52.335Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293291"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct\u003c/td\u003e\u003ctd\u003eVersion\u003c/td\u003e\u003ctd\u003eAPAR\u003c/td\u003e\u003ctd\u003eRemediation \u0026amp; Fix\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Sterling B2B Integrator\u003c/td\u003e\u003ctd\u003e6.2.1.0 - 6.2.1.2_1\u003c/td\u003e\u003ctd\u003eIT49839\u00a0\u003c/td\u003e\u003ctd\u003eApply 6.2.1.3\u00a0\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Sterling File Gateway\u003c/td\u003e\u003ctd\u003e6.2.1.0 - 6.2.1.2_1\u003c/td\u003e\u003ctd\u003eIT49839\u00a0\u003c/td\u003e\u003ctd\u003eApply 6.2.1.3\u00a0\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Sterling B2B Integrator\u003c/td\u003e\u003ctd\u003e6.2.2.0 - 6.2.2.1_1\u003c/td\u003e\u003ctd\u003eIT49839\u00a0\u003c/td\u003e\u003ctd\u003eApply 6.2.2.2\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Sterling File Gateway\u003c/td\u003e\u003ctd\u003e6.2.2.0 - 6.2.2.1_1\u003c/td\u003e\u003ctd\u003eIT49839\u00a0\u003c/td\u003e\u003ctd\u003eApply 6.2.2.2\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe IIM versions of 6.2.1.3 and 6.2.2.2 are available on\u00a0\u003ca href=\"http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Other%2Bsoftware\u0026amp;product=ibm/Other+software/Sterling+B2B+Integrator\u0026amp;release=All\u0026amp;platform=All\u0026amp;function=all\" rel=\"noopener noreferrer nofollow\"\u003eFix Central\u003c/a\u003e.\u00a0\u003c/p\u003e\u003cp\u003eThe container versions of 6.2.1.3 and 6.2.2.2 are available in IBM Entitled Registry\u003c/p\u003e\u003cul\u003e\u003cli\u003ecp.icr.io/cp/ibm-b2bi for IBM Sterling B2B Integrator\u003c/li\u003e\u003cli\u003ecp.icr.io/cp/ibm-sfg for IBM Sterling File Gateway\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "ProductVersionAPARRemediation \u0026 FixIBM Sterling B2B Integrator6.2.1.0 - 6.2.1.2_1IT49839\u00a0Apply 6.2.1.3\u00a0IBM Sterling File Gateway6.2.1.0 - 6.2.1.2_1IT49839\u00a0Apply 6.2.1.3\u00a0IBM Sterling B2B Integrator6.2.2.0 - 6.2.2.1_1IT49839\u00a0Apply 6.2.2.2IBM Sterling File Gateway6.2.2.0 - 6.2.2.1_1IT49839\u00a0Apply 6.2.2.2\n\n\n\n\n\n\n\nThe IIM versions of 6.2.1.3 and 6.2.2.2 are available on\u00a0 Fix Central http://www-933.ibm.com/support/fixcentral/swg/selectFixes .\u00a0\n\n\n\nThe container versions of 6.2.1.3 and 6.2.2.2 are available in IBM Entitled Registry\n\n * cp.icr.io/cp/ibm-b2bi for IBM Sterling B2B Integrator\n * cp.icr.io/cp/ibm-sfg for IBM Sterling File Gateway"
}
],
"title": "Sensitive Information in Log files affects IBM Sterling B2B Integrator and IBM Sterling File Gateway"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-81209",
"datePublished": "2026-11-08T18:40:52.335Z",
"dateReserved": "2026-08-26T17:02:25.085Z",
"dateUpdated": "2026-11-09T19:03:39.364Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-80435 (GCVE-0-2026-80435)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:40 – Updated: 2026-11-09 20:22
VLAI
EPSS
VEX
Title
DataStage on Cloud Pak for Data has several vulnerabilities
Summary
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:22 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7294270 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | DataStage on Cloud Pak for Data |
Affected:
5.4.0.0
cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-80435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:22:17.927063Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:22:34.918Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"
],
"product": "DataStage on Cloud Pak for Data",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "5.4.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.\u003c/p\u003e"
}
],
"value": "IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:40:33.097Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7294270"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003eVersion(s) number and/or range\u00a0\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eDataStage on Cloud Pak for Data\u003c/td\u003e\u003ctd\u003e5.4.0.0\u003c/td\u003e\u003ctd\u003e\u003cp\u003eUpgrade to 5.4 patch 8 or later by following these \u003ca href=\"https://www.ibm.com/docs/en/software-hub/5.4.x?topic=overview-available-patches-software-hub-version-540\" rel=\"nofollow\"\u003einstructions\u003c/a\u003e.\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading DataStage on Cloud Pak for Data.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsDataStage on Cloud Pak for Data5.4.0.0\n\nUpgrade to 5.4 patch 8 or later by following these instructions https://www.ibm.com/docs/en/software-hub/5.4.x ."
}
],
"title": "DataStage on Cloud Pak for Data has several vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-80435",
"datePublished": "2026-11-08T18:40:33.097Z",
"dateReserved": "2026-08-26T10:58:52.864Z",
"dateUpdated": "2026-11-09T20:22:34.918Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78636 (GCVE-0-2026-78636)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:40 – Updated: 2026-11-09 17:02
VLAI
EPSS
VEX
Title
IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities
Summary
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 17:02 UTC
CWE
- CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7295268 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | WebSphere Application Server - Liberty |
Affected:
17.0.0.3 , ≤ 26.0.0.10
(semver)
cpe:2.3:a:ibm:websphere_application_server_liberty:17.0.0.3:*:*:*:*:*:*:* cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.10:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78636",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T17:02:23.291107Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T17:02:31.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:websphere_application_server_liberty:17.0.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:websphere_application_server_liberty:26.0.0.10:*:*:*:*:*:*:*"
],
"product": "WebSphere Application Server - Liberty",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "26.0.0.10",
"status": "affected",
"version": "17.0.0.3",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.\u003c/p\u003e"
}
],
"value": "IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470 Use of Externally-Controlled Input to Select Classes or Code (\u0027Unsafe Reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:40:16.874Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7295268"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerabilities now by applying the fix pack(s) listed below.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eFor IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.10:\u003c/strong\u003e\u003cbr/\u003e\u00b7 Apply Liberty Fix Pack \u003ca href=\"https://www.ibm.com/support/pages/node/7294658\" rel=\"nofollow\"\u003e26.0.0.11\u003c/a\u003e (availability November 2026) or later fix pack.\u00a0\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerabilities now by applying the fix pack(s) listed below.\n\n\n\nFor IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.10:\n\u00b7 Apply Liberty Fix Pack 26.0.0.11 https://www.ibm.com/support/pages/node/7294658 (availability November 2026) or later fix pack."
}
],
"title": "IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-78636",
"datePublished": "2026-11-08T18:40:16.874Z",
"dateReserved": "2026-08-24T22:33:58.250Z",
"dateUpdated": "2026-11-09T17:02:31.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78537 (GCVE-0-2026-78537)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:39 – Updated: 2026-11-09 14:10
VLAI
EPSS
VEX
Title
IBM Guardium Key Lifecycle Manager is affected by a security vulnerability
Summary
IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 could allow a local attacker to obtain sensitive information due to the use of a weak cryptographic algorithm.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:10 UTC
CWE
- CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7292031 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Guardium Key Lifecycle Manager |
Affected:
4.1
Affected: 4.1.1 Affected: 4.2 Affected: 4.2.1 Affected: 5.0 Affected: 5.1 cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.1.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.1.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.2.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:guardium_key_lifecycle_manager:5.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:guardium_key_lifecycle_manager:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:guardium_key_lifecycle_manager:5.1:*:*:*:*:*:*:* cpe:2.3:a:ibm:guardium_key_lifecycle_manager:5.1.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78537",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:10:49.135086Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:10:58.185Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:guardium_key_lifecycle_manager:4.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:guardium_key_lifecycle_manager:5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:guardium_key_lifecycle_manager:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:guardium_key_lifecycle_manager:5.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:guardium_key_lifecycle_manager:5.1.0:*:*:*:*:*:*:*"
],
"product": "Guardium Key Lifecycle Manager",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"status": "affected",
"version": "4.1.1"
},
{
"status": "affected",
"version": "4.2"
},
{
"status": "affected",
"version": "4.2.1"
},
{
"status": "affected",
"version": "5.0"
},
{
"status": "affected",
"version": "5.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 could allow a local attacker to obtain sensitive information due to the use of a weak cryptographic algorithm.\u003c/p\u003e"
}
],
"value": "IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 could allow a local attacker to obtain sensitive information due to the use of a weak cryptographic algorithm."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-327",
"description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:39:50.259Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7292031"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eIBM encourages customers to update their systems promptly.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003ePrincipal Product and Version(s)\u003c/td\u003e\u003ctd\u003eRemediation/Fixes\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Key Lifecycle Manager (GKLM) v4.1\u003c/td\u003e\u003ctd\u003e\u003cp\u003e1. Download IBM Guardium Key Lifecycle Manager\u00a0\u003ca href=\"https://www.ibm.com/software/passportadvantage/pao-customer\" rel=\"nofollow\"\u003e(GKLM) v5.1\u003c/a\u003e (the product is available for download through\u003ca href=\"https://www.ibm.com/software/passportadvantage/pao-customer\" rel=\"nofollow\"\u003e IBM Passport Advantage)\u003c/a\u003e\u003c/p\u003e\u003cp\u003e2. Apply \u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FTivoli%2FIBM+Tivoli+Key+Lifecycle+Manager\u0026amp;fixids=5.1.0-ISS-GKLM-FP0003\u0026amp;source=SAR\u0026amp;function=fixId\u0026amp;parent=IBM%20Security\" rel=\"nofollow\"\u003e5.1.0-ISS-GKLM-FP0003\u003c/a\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Key Lifecycle Manager (GKLM) v4.1.1\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Key Lifecycle Manager (GKLM) v4.2\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Key Lifecycle Manager (GKLM) v4.2.1\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Key Lifecycle Manager (GKLM) v5.0\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Guardium Key Lifecycle Manager (GKLM) v5.1\u003c/td\u003e\u003ctd\u003eApply \u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FTivoli%2FIBM+Tivoli+Key+Lifecycle+Manager\u0026amp;fixids=5.1.0-ISS-GKLM-FP0003\u0026amp;source=SAR\u0026amp;function=fixId\u0026amp;parent=IBM%20Security\" rel=\"nofollow\"\u003e5.1.0-ISS-GKLM-FP0003\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003eDownload instruction -\u00a0\u003ca href=\"https://www.ibm.com/docs/en/gklm/5.x?topic=software-download-instructions\" rel=\"nofollow\"\u003ehttps://www.ibm.com/docs/en/gklm/5.x?topic=software-download-instructions\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "IBM encourages customers to update their systems promptly.\n\nPrincipal Product and Version(s)Remediation/FixesIBM Guardium Key Lifecycle Manager (GKLM) v4.1\n\n1. Download IBM Guardium Key Lifecycle Manager\u00a0 https://www.ibm.com/docs/en/gklm/5.x?topic=software-download-instructions"
}
],
"title": "IBM Guardium Key Lifecycle Manager is affected by a security vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-78537",
"datePublished": "2026-11-08T18:39:50.259Z",
"dateReserved": "2026-08-24T17:33:44.955Z",
"dateUpdated": "2026-11-09T14:10:58.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77153 (GCVE-0-2026-77153)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:38 – Updated: 2026-11-08 18:38
VLAI
EPSS
VEX
Title
IBM i is Affected By Missing Authorization Vulnerability in Host-Based Printer Subsystem []
Summary
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to obtain sensitive information from the Host-Based Printer Subsystem due to no authorization check. A bad actor could use this vulnerability to print files they should not be able to access.
Severity
4.8 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7294253 | vendor-advisorypatch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:i:7.6:*:*:*:*:*:*:*"
],
"product": "i",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.6"
},
{
"status": "affected",
"version": "7.5"
},
{
"status": "affected",
"version": "7.4"
},
{
"status": "affected",
"version": "7.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to obtain sensitive information from the Host-Based Printer Subsystem due to no authorization check. A bad actor could use this vulnerability to print files they should not be able to access.\u003c/p\u003e"
}
],
"value": "IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to obtain sensitive information from the Host-Based Printer Subsystem due to no authorization check. A bad actor could use this vulnerability to print files they should not be able to access."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:38:57.177Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7294253"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen using Access Client Solutions (ACS) to create Telnet printer sessions, version 1.1.9.15 or later must be installed for interoperability after applying the Host-Based Printer Subsystem PTFs.\u00a0 Failure to update to a compatible ACS application version will result in being unable to connect via telnet for printing. The current version of the ACS application can be viewed by clicking the \u0027About\u0027 link under the \u0027Help\u0027 tab in ACS.\u003c/p\u003e\u003cp\u003eView each PTF\u0027s cover letter for the additional actions required prior to installation.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003cthead\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eIBM i Release\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003e5770-SS1\u00a0\u003cbr/\u003ePTF Number(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003ePTF Download Link(s)\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/thead\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e7.6\u003c/td\u003e\u003ctd\u003eSJ11502\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11502\" rel=\"nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11502\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.5\u003c/td\u003e\u003ctd\u003eSJ11523\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11523\" rel=\"nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11523\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.4\u003c/td\u003e\u003ctd\u003eSJ11524\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11524\" rel=\"nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11524\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e7.3\u003c/td\u003e\u003ctd\u003eSJ11522\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11522\" rel=\"nofollow\"\u003ehttps://www.ibm.com/mysupport/s/fix-information?legacy=SJ11522\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003eIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products.\u003c/p\u003e"
}
],
"value": "When using Access Client Solutions (ACS) to create Telnet printer sessions, version 1.1.9.15 or later must be installed for interoperability after applying the Host-Based Printer Subsystem PTFs.\u00a0 Failure to update to a compatible ACS application version will result in being unable to connect via telnet for printing. The current version of the ACS application can be viewed by clicking the \u0027About\u0027 link under the \u0027Help\u0027 tab in ACS.\n\n\n\nView each PTF\u0027s cover letter for the additional actions required prior to installation.\n\nIBM i Release5770-SS1\u00a0\nPTF Number(s)PTF Download Link(s)7.6SJ11502 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11502 7.5SJ11523 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11523 7.4SJ11524 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11524 7.3SJ11522 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ11522 \n\n\n\nIBM recommends users running unsupported versions of affected products upgrade to a supported and fixed version of affected products."
}
],
"title": "IBM i is Affected By Missing Authorization Vulnerability in Host-Based Printer Subsystem []"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-77153",
"datePublished": "2026-11-08T18:38:57.177Z",
"dateReserved": "2026-08-20T14:17:43.049Z",
"dateUpdated": "2026-11-08T18:38:57.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75879 (GCVE-0-2026-75879)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:38 – Updated: 2026-11-09 20:29
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in IBM Content Navigator and FasterXML jackson-databind in IBM Content Navigator
Summary
IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 is vulnerable to LDAP injection. A remote authenticated attacker could send a specially crafted request that could allow enumeration of LDAP directory information.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 20:29 UTC
CWE
- CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7295227 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Content Navigator |
Affected:
3.0.15.0
Affected: 26.0.0.0 Affected: 3.1.0.0 Affected: 3.2.0.0 cpe:2.3:a:ibm:content_navigator:3.0.15.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:content_navigator:26.0.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:content_navigator:3.1.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:content_navigator:3.2.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75879",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T20:29:12.164591Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-90",
"description": "CWE-90 Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T20:29:46.836Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:content_navigator:3.0.15.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:content_navigator:26.0.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:content_navigator:3.1.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:content_navigator:3.2.0.0:*:*:*:*:*:*:*"
],
"product": "Content Navigator",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "3.0.15.0"
},
{
"status": "affected",
"version": "26.0.0.0"
},
{
"status": "affected",
"version": "3.1.0.0"
},
{
"status": "affected",
"version": "3.2.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 is vulnerable to LDAP injection. A remote authenticated attacker could send a specially crafted request that could allow enumeration of LDAP directory information.\u003c/p\u003e"
}
],
"value": "IBM Content Navigator 3.0.15.0, 26.0.0.0, 3.1.0.0, and 3.2.0.0 is vulnerable to LDAP injection. A remote authenticated attacker could send a specially crafted request that could allow enumeration of LDAP directory information."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:38:34.341Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7295227"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eAffected Product(s)\u003c/td\u003e\u003ctd\u003eVersion(s)\u003c/td\u003e\u003ctd\u003eRemediation / Fix\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Content Navigator\u003c/td\u003e\u003ctd\u003e3.0.15.0\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Enterprise%20Content%20Management\u0026amp;product=ibm/Other+software/Content+Navigator\u0026amp;release=3.0.15\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=3.0.15.0-ICN-IF011-AIX,3.0.15.0-ICN-IF011-WIN,3.0.15.0-ICN-IF011-Linux,3.0.15.0-ICN-IF011-ZLinux,3.0.15-ICNSP-IF011-WIN,3.0.15-NES-IF011-WIN\u0026amp;includeSupersedes=0\" rel=\"nofollow\"\u003eApply security fix 3.0.15-IF011\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Content Navigator\u003c/td\u003e\u003ctd\u003e26.0.0.0\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Enterprise%20Content%20Management\u0026amp;product=ibm/Other+software/Content+Navigator\u0026amp;release=26.0.0\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=26.0.0.0-ICN-IF004-AIX+,26.0.0.0-ICN-IF004-Linux+,26.0.0.0-ICN-IF004-WIN+,26.0.0.0-ICN-IF004-ZLinux+,26.0.0-ICNSP-IF004-WIN+,26.0.0-NES-IF004-WIN\u0026amp;includeSupersedes=0\" rel=\"nofollow\"\u003eApply security fix 26.0.0-IF004\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Content Navigator\u003c/td\u003e\u003ctd\u003e3.1.0.0\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Enterprise%20Content%20Management\u0026amp;product=ibm/Other+software/Content+Navigator\u0026amp;release=3.1.0\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=3.1.0.0-ICN-IF013-AIX,3.1.0.0-ICN-IF013-Linux,3.1.0.0-ICN-IF013-WIN,3.1.0.0-ICN-IF013-ZLinux,3.1.0-ICNSP-IF013-WIN\u0026amp;includeSupersedes=0\" rel=\"nofollow\"\u003eApply security fix 3.1.0-IF013\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Content Navigator\u003c/td\u003e\u003ctd\u003e3.2.0.0\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Enterprise%20Content%20Management\u0026amp;product=ibm/Other+software/Content+Navigator\u0026amp;release=3.2.0\u0026amp;platform=All\u0026amp;function=fixId\u0026amp;fixids=3.2.0.0-ICN-IF008-AIX,3.2.0.0-ICN-IF008-Linux,3.2.0.0-ICN-IF008-WIN,3.2.0.0-ICN-IF008-ZLinux,3.2.0-ICNSP-IF008-WIN\u0026amp;includeSupersedes=0\" rel=\"nofollow\"\u003eApply security fix 3.2.0-IF008\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading.\n\nAffected Product(s)Version(s)Remediation / FixIBM Content Navigator3.0.15.0 Apply security fix 3.0.15-IF011 https://www.ibm.com/support/fixcentral/swg/selectFixes IBM Content Navigator26.0.0.0 Apply security fix 26.0.0-IF004 https://www.ibm.com/support/fixcentral/swg/selectFixes IBM Content Navigator3.1.0.0 Apply security fix 3.1.0-IF013 https://www.ibm.com/support/fixcentral/swg/selectFixes IBM Content Navigator3.2.0.0 Apply security fix 3.2.0-IF008 https://www.ibm.com/support/fixcentral/swg/selectFixes"
}
],
"title": "Multiple vulnerabilities in IBM Content Navigator and FasterXML jackson-databind in IBM Content Navigator"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-75879",
"datePublished": "2026-11-08T18:38:34.341Z",
"dateReserved": "2026-08-18T12:47:34.015Z",
"dateUpdated": "2026-11-09T20:29:46.836Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6715 (GCVE-0-2026-6715)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:38 – Updated: 2026-11-09 21:04
VLAI
EPSS
VEX
Title
Multiple Vulnerabilities in IBM Concert Software
Summary
IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 21:04 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7294607 | vendor-advisorypatch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6715",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T21:04:23.037858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:04:34.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:concert:1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*"
],
"product": "Concert",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "3.0.1.1",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.\u003c/p\u003e"
}
],
"value": "IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:38:13.002Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7294607"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing these vulnerabilities now by upgrading to IBM Concert Software 3.1.0\u003c/p\u003e\u003cp\u003eDownload IBM Concert Software 3.1.0 from Container software library section of IBM Entitled Registry (\u003ca href=\"https://myibm.ibm.com/products-services/containerlibrary\" rel=\"noopener noreferrer nofollow\"\u003eICR\u003c/a\u003e) and follow\u00a0\u003ca href=\"https://www.ibm.com/docs/en/concert?topic=installing-preparing-run-installs-from-private-container-registry\" rel=\"noopener noreferrer nofollow\"\u003einstallation instructions\u003c/a\u003e\u00a0depending on the type of deployment.\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing these vulnerabilities now by upgrading to IBM Concert Software 3.1.0\n\n\n\nDownload IBM Concert Software 3.1.0 from Container software library section of IBM Entitled Registry ( ICR https://myibm.ibm.com/products-services/containerlibrary ) and follow\u00a0 installation instructions https://www.ibm.com/docs/en/concert \u00a0depending on the type of deployment."
}
],
"title": "Multiple Vulnerabilities in IBM Concert Software"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-6715",
"datePublished": "2026-11-08T18:38:13.002Z",
"dateReserved": "2026-04-20T18:45:25.752Z",
"dateUpdated": "2026-11-09T21:04:34.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3684 (GCVE-0-2026-3684)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:32 – Updated: 2026-11-09 21:10
VLAI
EPSS
VEX
Title
Vulnerabilities exists in IBM Cloud Pak for Data System
Summary
IBM Cloud Pak for Data System 11.3.1.2 Interim Fix 001 through - 11.3.1.2 Interim Fix 002 could allow a user with administrative privileges to read and write arbitrary files on the system due to incorrect permission assignments.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 21:08 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293239 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Cloud Pak for Data System |
Affected:
11.3.1.2 Interim Fix 001 , ≤ 11.3.1.2 Interim Fix 002
(semver)
cpe:2.3:a:ibm:cloud_pak_for_data_system:11.3.1.2:interim_fix_001:*:*:*:*:*:* cpe:2.3:a:ibm:cloud_pak_for_data_system:11.3.1.2:interim_fix_002:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3684",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T21:08:23.978879Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:10:02.059Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:cloud_pak_for_data_system:11.3.1.2:interim_fix_001:*:*:*:*:*:*",
"cpe:2.3:a:ibm:cloud_pak_for_data_system:11.3.1.2:interim_fix_002:*:*:*:*:*:*"
],
"product": "Cloud Pak for Data System",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "11.3.1.2 Interim Fix 002",
"status": "affected",
"version": "11.3.1.2 Interim Fix 001",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Cloud Pak for Data System 11.3.1.2 Interim Fix 001\u0026nbsp;through - 11.3.1.2 Interim Fix 002 could allow a user with administrative privileges to read and write arbitrary files on the system due to incorrect permission assignments.\u003c/p\u003e"
}
],
"value": "IBM Cloud Pak for Data System 11.3.1.2 Interim Fix 001\u00a0through - 11.3.1.2 Interim Fix 002 could allow a user with administrative privileges to read and write arbitrary files on the system due to incorrect permission assignments."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:32:19.762Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293239"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly encourages customers to update their systems promptly.\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eFixed Version\u003c/td\u003e\u003ctd\u003e\u003cp\u003eRemediation/Fixes\u00a0\u200b\u200c\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Cloud Pak for Data System (Yosemite 1.0)\u003c/td\u003e\u003ctd\u003e\u003ca href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FWebSphere%2FIBM+Cloud+Private+for+Data+System\u0026amp;fixids=11.3.1.2-IF3-WS-ICPDS-1x-NPS-fp367344\u0026amp;source=SAR\u0026amp;function=fixId\u0026amp;parent=ibm/WebSphere\" rel=\"nofollow\"\u003e11.3.1.2-IF3-WS-ICPDS-1x-NPS-fp367344\u0026amp;\u003c/a\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
}
],
"value": "IBM strongly encourages customers to update their systems promptly.\n\nFixed Version\n\nRemediation/Fixes\u00a0\u200b\u200c\n\n\n\n\n\nIBM Cloud Pak for Data System (Yosemite 1.0) 11.3.1.2-IF3-WS-ICPDS-1x-NPS-fp367344\u0026 https://www.ibm.com/support/fixcentral/swg/selectFixes"
}
],
"title": "Vulnerabilities exists in IBM Cloud Pak for Data System"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-3684",
"datePublished": "2026-11-08T18:32:19.762Z",
"dateReserved": "2026-03-06T21:54:25.661Z",
"dateUpdated": "2026-11-09T21:10:02.059Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2700 (GCVE-0-2026-2700)
Vulnerability from cvelistv5 – Published: 2026-11-08 18:30 – Updated: 2026-11-09 14:11
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
Summary
IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:11 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
ibm
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7293785 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | watsonx Orchestrate Cartridge for Cloud Pak for Data |
Affected:
4.8.4 , ≤ 4.8.5
(semver)
Affected: 5.0.0 , ≤ 5.4.2 (semver) cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2700",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:11:09.398497Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:11:17.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.4:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:4.8.5:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:watsonx_orchestrate_cartridge_for_cloud_pak_for_data:5.4.2:*:*:*:*:*:*:*"
],
"product": "watsonx Orchestrate Cartridge for Cloud Pak for Data",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "4.8.5",
"status": "affected",
"version": "4.8.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.2",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control.\u003c/p\u003e"
}
],
"value": "IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T18:30:20.823Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7293785"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises\u003c/a\u003e\u003c/p\u003e"
}
],
"value": "IBM strongly recommends addressing the vulnerability now by upgrading to IBM watsonx Orchestrate Cartridge 5.4.4\n\n\n\n https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current?topic=installing-watsonx-orchestrate-premises"
}
],
"title": "Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-2700",
"datePublished": "2026-11-08T18:30:20.823Z",
"dateReserved": "2026-02-18T16:34:10.020Z",
"dateUpdated": "2026-11-09T14:11:17.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}