IBM DevOps Deploy CVE-2026-12084

Exploitation requires the affected component's misconfigured CORS policy (present by default in DevOps Deploy 8.1.0-8.1.2.6 and 8.2.0-8.2.1.0) to reflect or trust untrusted origins, and - because the attack is browser-mediated - a currently authenticated DevOps Deploy user must visit or interact with an attacker-controlled web page while their session is valid. Limiting factors: the attacker cannot directly authenticate, so success depends on an active victim session and successful lure (social engineering / phishing), and the impact is bounded by that victim's privilege level; network reachability to the console from the victim's browser is also required. The vendor vector lists UI:N and PR:N, but the CORS mechanism in practice depends on an authenticated victim's browser action, which materially constrains real-world exploitation.

Signals are broadly consistent toward moderate, not urgent, risk. IBM's CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable, low-complexity confidentiality-only impact, but the mechanics of a CORS attack realistically require an authenticated victim to visit an attacker-controlled page - an interaction the vendor's UI:N does not capture, so raw score likely overstates ease. EPSS (0.15%), CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: partial), absence of KEV listing, and no known POC all point to low real-world exploitation likelihood. The vendor vector marks I:N (no integrity impact), yet the description explicitly says an attacker could 'carry out privileged actions,' which implies at least limited integrity impact - a discrepancy worth verifying with IBM. Net: a legitimate patch-worthy flaw for exposed consoles, but not an emergency relative to actively exploited vulnerabilities.

An attacker crafts a malicious web page and sends a phishing link to a DevOps Deploy operator who has an active authenticated console session. When the operator opens the page, embedded JavaScript issues cross-origin requests to the DevOps Deploy API; because the CORS policy accepts the attacker's origin, the browser returns the authenticated responses, letting the attacker exfiltrate sensitive deployment data and trigger privileged actions under the victim's identity. No public POC is known, and the low complexity (AC:L) is offset by the need to reach an authenticated user.