What is the CVSS score of CVE-2026-12085?

CVE-2026-12085 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

IBM DevOps Deploy CVE-2026-12085

EUVD-2026-40391 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-30 psirt@us.ibm.com

GHSA-6qv6-3qwf-mmv5

Information Disclosure IBM Devops Deploy Urbancode Deploy

6.5

CVSS 3.1 · Vendor: us

Severity by source

Vendor (us) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible API (AV:N, AC:L), requires authenticated low-privilege user (PR:L), confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (us).

CVSS VectorVendor: us

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 20:37 vuln.today

DescriptionCVE.org

IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.

AnalysisAI

Sensitive configuration and secret disclosure in IBM UrbanCode Deploy (7.3-7.3.2.18) and IBM DevOps Deploy (8.0-8.2.1.0) exposes credentials and configuration data to any authenticated low-privilege user via API responses. The exposed secrets can serve as a direct launchpad for privilege escalation or lateral movement within the CI/CD pipeline and connected deployment targets. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS-assigned high confidentiality impact reflects real post-authentication risk.

Technical ContextAI

IBM UrbanCode Deploy (UCD) and its successor IBM DevOps Deploy are enterprise CI/CD deployment automation platforms that manage application deployments across heterogeneous environments, storing credentials, API keys, and environment-specific configurations as part of their pipeline definitions. The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data), a class of vulnerability where server-side API responses inadvertently include secrets - such as deployment credentials, environment variables, or integration tokens - that should be filtered or masked before transmission. The CVSS vector (AV:N/AC:L/PR:L) indicates the vulnerable API endpoints are reachable over the network by any authenticated user, with no special configuration required. The affected versions span UCD 7.3 through 7.3.2.18 and DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0.

RemediationAI

Consult the IBM security advisory at https://www.ibm.com/support/pages/node/7277577 for exact patched version numbers; the advisory is the authoritative source since no specific fix version was included in the available intelligence data. Upgrade IBM UrbanCode Deploy beyond 7.3.2.18 and IBM DevOps Deploy beyond the respective 8.0.1.13, 8.1.2.6, and 8.2.1.0 thresholds per IBM's published fix targets. As a compensating control prior to patching, restrict API access to the affected endpoints at the network layer, limiting access to only those user accounts that operationally require it - this reduces the exposed attack surface without disrupting deployments. Additionally, audit current secret storage to rotate any credentials that may have been exposed to low-privilege API consumers, prioritizing secrets used for downstream deployment targets. Treat any secrets stored in the platform as potentially compromised until rotation is complete.