Planning Analytics Local CVE-2025-14806

While the CVSS 3.1 base score is 5.7 (Medium severity), multiple risk signals warrant closer analysis. The attack vector is Network (AV:N) with Low complexity (AC:L), meaning exploitation is straightforward once the vulnerability is understood. The requirement for Login (PR:L) and User Interaction (UI:R) moderates the practical attack surface but does not eliminate it—authenticated users or low-privileged accounts can trigger the vulnerability. The impact is High Confidentiality (C:H) with no integrity or availability impact, aligning with the information disclosure nature. Critical for prioritization: no KEV (Known Exploited Vulnerability) status is documented in the intelligence provided, and no public POC has been identified, suggesting active exploitation is not yet widespread. However, the straightforward nature of cache poisoning (low AC:L) combined with sensitive nature of Planning Analytics data (financial forecasts, personnel planning, etc.) means this should be treated as a priority-3 issue in organizations using affected versions. The availability of a vendor patch further supports prompt remediation over extended risk acceptance.

An attacker authenticates to IBM Planning Analytics Local with a low-privilege account (e.g., read-only analyst role) and navigates to a user-specific dashboard or report page that displays confidential information such as headcount forecasts or financial projections tied to their user session. Due to the caching vulnerability, the HTTP response containing this sensitive data is cached with public visibility flags. A second, unauthenticated user (or a different authenticated user) subsequently requests the same resource URL via a shared proxy or corporate cache, and receives the cached sensitive response without any authentication check. The attacker can enumerate sensitive URLs and extract confidential planning data affecting multiple departments or business units. No public POC exists yet, but the low attack complexity (AC:L) means exploitation can be achieved through simple HTTP request manipulation and cache invalidation timing.