What is the CVSS score of CVE-2026-12085?

CVE-2026-12085 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

IBM DevOps Deploy CVE-2026-12085

EUVD-2026-40391 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-30 psirt@us.ibm.com

GHSA-6qv6-3qwf-mmv5

IBM Information Disclosure Devops Deploy Urbancode Deploy

6.5

CVSS 3.1 · Vendor: us

Severity by source

Vendor (us) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible API (AV:N, AC:L), requires authenticated low-privilege user (PR:L), confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (us).

CVSS VectorVendor: us

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 20:37 vuln.today

DescriptionCVE.org

IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.

AnalysisAI

Sensitive configuration and secret disclosure in IBM UrbanCode Deploy (7.3-7.3.2.18) and IBM DevOps Deploy (8.0-8.2.1.0) exposes credentials and configuration data to any authenticated low-privilege user via API responses. The exposed secrets can serve as a direct launchpad for privilege escalation or lateral movement within the CI/CD pipeline and connected deployment targets. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate with low-privilege DevOps Deploy credentials

Delivery

Query pipeline or environment API endpoint

Exploit

Extract secrets from API response

Execution

Use harvested credentials against deployment targets

Impact

Access or persist on downstream systems

Access

Authenticate with low-privilege DevOps Deploy credentials

Delivery

Query pipeline or environment API endpoint

Exploit

Extract secrets from API response

Execution

Use harvested credentials against deployment targets

Impact

Access or persist on downstream systems

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid authenticated session with at minimum low-privilege access to the IBM UrbanCode Deploy or IBM DevOps Deploy instance (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 6.5 medium score is technically accurate but potentially understates business risk in environments where DevOps Deploy manages secrets for critical infrastructure deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a valid low-privilege account - such as a developer or read-only auditor provisioned within IBM DevOps Deploy - queries a pipeline or environment configuration API endpoint and receives a response that includes plaintext or minimally obfuscated secrets such as SSH keys, database passwords, or cloud provider tokens. The attacker extracts these credentials and uses them to authenticate directly to deployment targets or cloud environments managed by the pipeline, bypassing normal access controls. …
Remediation	Consult the IBM security advisory at https://www.ibm.com/support/pages/node/7277577 for exact patched version numbers; the advisory is the authoritative source since no specific fix version was included in the available intelligence data. … Detailed patch versions, workarounds, and compensating controls in full report.