What is the CVSS score of CVE-2025-14806?

CVE-2025-14806 has a CVSS 3.1 base score of 5.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Planning Analytics Local are affected by CVE-2025-14806?

CVE-2025-14806 presents moderate security risk rated CVSS 5.7. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-14806?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Planning Analytics Local CVE-2025-14806

EUVD-2025-208810 MEDIUM

Use of Cache Containing Sensitive Information (CWE-524)

2026-03-17 ibm

Information Disclosure IBM Planning Analytics Local

5.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.7 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 22:08 euvd

EUVD-2025-208810

Analysis Generated

Mar 17, 2026 - 22:08 vuln.today

Patch released

Mar 17, 2026 - 22:08 nvd

Patch available

CVE Published

Mar 17, 2026 - 21:50 nvd

MEDIUM 5.7

DescriptionCVE.org

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.

AnalysisAI

IBM Planning Analytics Local versions 2.1.0 through 2.1.17 contain a cache poisoning vulnerability (CWE-524) where attackers can manipulate the caching mechanism to store and serve sensitive, user-specific responses as publicly cacheable resources, resulting in information disclosure to unauthorized users. The vulnerability requires low attack complexity and user interaction but only affects confidentiality with a CVSS score of 5.7. A patch is available from the vendor, and this represents a moderate-priority issue requiring prompt remediation in production environments handling sensitive analytical data.

Technical ContextAI

This vulnerability stems from improper cache control implementation in IBM Planning Analytics Local (confirmed via CPE cpe:2.3:a:ibm:planning_analytics_local:*:*:*:*:*:*:*:*), classified under CWE-524 (Uncontrolled Write to File with Dangerous File Extensions). The root cause involves the HTTP caching mechanism failing to properly mark user-specific responses as non-cacheable, allowing responses containing sensitive planning, analytical, or user-profile data to be stored in shared caches (browser, intermediary, or CDN proxies). Attackers exploit this by crafting requests that generate user-specific responses, which the cache then incorrectly treats as public content. This is a cache poisoning attack that violates HTTP Cache-Control semantics and authentication boundaries.

RemediationAI

Upgrade IBM Planning Analytics Local to version 2.1.18 or later as soon as operationally feasible; patch downloads and detailed instructions are available in the IBM security advisory at https://www.ibm.com/support/pages/node/7263581. As an interim compensating control, enforce strict HTTP Cache-Control headers (Cache-Control: private, no-store) at the reverse proxy or application gateway level for all Planning Analytics Local endpoints, implement HTTPS with HSTS (Strict-Transport-Security) to prevent downgrade attacks, and restrict network access to Planning Analytics to internal networks or VPN-connected users only. Disable shared caching proxies for Planning Analytics traffic if feasible, or configure them to respect all private/no-store directives. Monitor web server and proxy logs for suspicious cache access patterns (repeated requests from different sources for user-specific URLs) and consider implementing content security policies to limit cache visibility.