IBM DevOps Deploy CVE-2026-12085

Exploitation requires a valid authenticated session with at minimum low-privilege access to the IBM UrbanCode Deploy or IBM DevOps Deploy instance (PR:L per CVSS). No special configuration or non-default feature enablement is indicated - the vulnerability appears present in standard deployments of the affected version ranges. What limits exploitation: (1) an attacker must possess valid credentials to the affected system, ruling out unauthenticated external attackers; (2) the impact is confidentiality-only - secrets exposure enables further attacks but does not directly alter system integrity or availability; (3) exploitation is constrained to affected version ranges (UCD 7.3-7.3.2.18, DevOps Deploy 8.0-8.0.1.13, 8.1-8.1.2.6, 8.2-8.2.1.0). Insider threats, compromised low-privilege accounts, or shared-access developer environments represent the realistic attacker profile.

The CVSS 6.5 medium score is technically accurate but potentially understates business risk in environments where DevOps Deploy manages secrets for critical infrastructure deployments. The PR:L requirement means an attacker must first be an authenticated user - a meaningful barrier - but in enterprise environments, low-privilege accounts (developers, auditors, contractors) are commonly provisioned, making this a realistic threat. The C:H rating reflects that exposed secrets are not merely metadata but actionable credentials enabling further attacks. No EPSS data was provided for comparison. There is no CISA KEV listing and no known public exploit code, consistent with a lower immediate exploitation probability. However, the information disclosure enables a two-stage attack pattern: credential harvesting followed by lateral movement to deployment targets, which substantially amplifies the downstream impact beyond the raw score. The attack requires no user interaction and no elevated complexity once authentication is satisfied - risk is real but bounded to authenticated principals.

An attacker with a valid low-privilege account - such as a developer or read-only auditor provisioned within IBM DevOps Deploy - queries a pipeline or environment configuration API endpoint and receives a response that includes plaintext or minimally obfuscated secrets such as SSH keys, database passwords, or cloud provider tokens. The attacker extracts these credentials and uses them to authenticate directly to deployment targets or cloud environments managed by the pipeline, bypassing normal access controls. No exploit code is publicly known, but this scenario requires only authenticated API access and basic HTTP tooling.