{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17466",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T20:07:16.718265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T20:07:24.785Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:optim:1.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:optim:1.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:optim:1.2.0:*:*:*:*:*:*:*"
          ],
          "product": "Optim",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0"
            },
            {
              "status": "affected",
              "version": "1.1.0"
            },
            {
              "status": "affected",
              "version": "1.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.\u003c/p\u003e"
            }
          ],
          "value": "IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-08T17:51:39.935Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7289719"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM strongly recommends addressing the vulnerability now.\u003c/p\u003e\u003cp\u003eMove to IBM Optim Test Data Management 2.0.0 IBM Optim Test Data Management 2.0.0 resolves all three vulnerabilities.\u003c/p\u003e\u003cp\u003eFile Path Traversal (ID: 218782) \u2014 The application now validates that file paths requested by users stay within the permitted directory. Any request attempting to access files outside that boundary is rejected.\u003c/p\u003e\u003cp\u003eNo Rate Limit (ID: 218776) \u2014 The application now enforces request rate limits per user on protected endpoints and per IP address on login endpoints. Requests that exceed the limit are blocked until the rate drops back within bounds.\u003c/p\u003e\u003cp\u003eWeak Password Policy (ID: 218648) \u2014 Default accounts and passwords have been removed. A unique administrator password is now generated automatically during installation.\u003cbr/\u003e\u003cbr/\u003e\u003cbr/\u003eAvailable from \u003ca href=\"https://www.ibm.com/software/passportadvantage/pao-customer\" rel=\"nofollow\"\u003ehttps://www.ibm.com/software/passportadvantage/pao-customer\u003c/a\u003e\u003c/p\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now.\n\n\n\nMove to IBM Optim Test Data Management 2.0.0 IBM Optim Test Data Management 2.0.0 resolves all three vulnerabilities.\n\n\n\nFile Path Traversal (ID: 218782) \u2014 The application now validates that file paths requested by users stay within the permitted directory. Any request attempting to access files outside that boundary is rejected.\n\n\n\nNo Rate Limit (ID: 218776) \u2014 The application now enforces request rate limits per user on protected endpoints and per IP address on login endpoints. Requests that exceed the limit are blocked until the rate drops back within bounds.\n\n\n\nWeak Password Policy (ID: 218648) \u2014 Default accounts and passwords have been removed. A unique administrator password is now generated automatically during installation.\n\n\nAvailable from  https://www.ibm.com/software/passportadvantage/pao-customer"
        }
      ],
      "title": "IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-17466",
    "datePublished": "2026-11-08T17:51:39.935Z",
    "dateReserved": "2026-07-25T20:16:15.375Z",
    "dateUpdated": "2026-11-09T20:07:24.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}