IBM CVE-2026-0977

The CVSS v3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates a local attack vector with low complexity, requiring no privileges and no user interaction, resulting in low confidentiality and integrity impact with no availability impact. The base score of 5.1 reflects a medium-severity local vulnerability. The local-only attack vector (AV:L) significantly reduces real-world risk compared to a network-exploitable flaw, as it requires prior system access. However, the PR:N (no privileges required) and AC:L (low complexity) characteristics mean any local user—including unprivileged accounts or compromised service accounts—can exploit this. Without KEV status confirmation or public exploit code, the immediate operational risk is moderate; however, in shared hosting, containerized, or multi-tenant environments where local access is more readily available, this becomes a higher priority. The vulnerability should be prioritized for patching in high-value transaction processing environments but does not warrant emergency response in networks with strong local access controls.

An attacker who has gained local system access to a server running IBM CICS Transaction Gateway 9.3 or 10.1 (for example, via a compromised application account or SSH access to a shared Linux/Unix server) can leverage the improper access control flaw to read sensitive transaction data or configuration files stored within the CTG file system without providing valid credentials. Because the vulnerability requires no additional privileges (PR:N) and involves low attack complexity (AC:L), the attacker can execute file operations directly through standard system commands or scripting, bypassing the application's intended authentication layer and accessing confidential business transaction records or gateway configuration secrets. This is particularly dangerous in multi-tenant environments where multiple customer applications share a single CTG instance.