{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108292",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T20:03:40.064048Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T20:03:49.480Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*"
          ],
          "product": "Process Mining",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "2.2.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened.\u003c/p\u003e"
            }
          ],
          "value": "IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T16:55:44.717Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7294875"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eProduct(s)\u003c/td\u003e\u003ctd\u003eVersion(s) number and/or range\u00a0\u003c/td\u003e\u003ctd\u003eRemediation/Fix/Instructions\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Process Mining OCP\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cp\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\u003cbr/\u003e\u003cbr/\u003eUpgrade to version 2.2.1 IF001\u003cbr/\u003e\u003ca href=\"https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\" rel=\"nofollow\"\u003ehttps://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001\u003c/a\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003euniIBM Process Mining On-Prem\u003c/td\u003e\u003ctd\u003e2.0.0 - 2.2.1\u003c/td\u003e\u003ctd\u003e\u003cdiv\u003eIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\u003cbr/\u003e\u003cbr/\u003eSteps\u003cbr/\u003e1. Go to IBM Support Portal\u003cbr/\u003eNavigate to \u003ca href=\"https://ibm.com/mysupport\" rel=\"nofollow\"\u003ehttps://ibm.com/mysupport\u003c/a\u003e and sign in with your IBMid before proceeding.\u003cbr/\u003e2. Open a case\u003c/div\u003e\u003cul\u003e\u003cli\u003eClick \"Open a case\" from the support portal.\u003c/li\u003e\u003cli\u003eSelect IBM Process Mining as the product.\u003c/li\u003e\u003cli\u003eFill in the case details, referencing the published security advisory: \u003ca href=\"https://www.ibm.com/support/pages/node/7294875\" rel=\"noopener noreferrer nofollow\"\u003ehttps://www.ibm.com/support/pages/node/7294875\u003c/a\u003e\u003c/li\u003e\u003cli\u003eRequest the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\u003c/li\u003e\u003c/ul\u003e\u003cdiv\u003e3. Obtain the fix\u003cbr/\u003eThe interim fix will be delivered directly through your support case once it has been opened.\u003c/div\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e"
            }
          ],
          "value": "Product(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM Process Mining OCP2.0.0 - 2.2.1\n\nIBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001\n\nUpgrade to version 2.2.1 IF001\n https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001 \n\n\n\n\n\nuniIBM Process Mining On-Prem2.0.0 - 2.2.1IBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1\n\nSteps\n1. Go to IBM Support Portal\nNavigate to  https://ibm.com/mysupport  and sign in with your IBMid before proceeding.\n2. Open a case\n\n  *  Click \"Open a case\" from the support portal.\n  *  Select IBM Process Mining as the product.\n  *  Fill in the case details, referencing the published security advisory:  https://www.ibm.com/support/pages/node/7294875 \n  *  Request the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities.\n\n\n3. Obtain the fix\nThe interim fix will be delivered directly through your support case once it has been opened."
        }
      ],
      "title": "Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-108292",
    "datePublished": "2026-11-08T16:55:44.717Z",
    "dateReserved": "2026-10-09T18:00:53.361Z",
    "dateUpdated": "2026-11-09T20:03:49.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}