What is the CVSS score of CVE-2026-12086?

CVE-2026-12086 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

IBM UrbanCode Deploy CVE-2026-12086

EUVD-2026-40390 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-06-30 psirt@us.ibm.com

GHSA-54jp-jq2r-6hfw

Information Disclosure IBM Devops Deploy Urbancode Deploy

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.2 MEDIUM

Local vector confirmed by description; PR:N reflects world-readable log files; C:H for potentially high-value secrets; no integrity or availability impact.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 02, 2026 - 18:37 NVD

6.2 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jun 30, 2026 - 20:38 vuln.today

DescriptionNVD

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 stores potentially sensitive information in log files that could be read by a local user.

AnalysisAI

Sensitive information disclosure in IBM UrbanCode Deploy and IBM DevOps Deploy exposes potentially sensitive data to any local user who can read application log files. Affected are UrbanCode Deploy 7.2 through 7.2.3.23 and 7.3 through 7.3.2.18, as well as DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the local no-privilege vector combined with high confidentiality impact makes this a meaningful insider threat and post-compromise escalation vector in enterprise CI/CD environments.

Technical ContextAI

IBM UrbanCode Deploy and its successor IBM DevOps Deploy are enterprise continuous delivery and deployment automation platforms widely used in large organizations to orchestrate application releases across hybrid environments. CWE-532 (Insertion of Sensitive Information into Log File) describes a root cause where the application writes credentials, tokens, API keys, environment variables, or other secrets into log files during normal operation - such as during deployment pipeline execution, agent communication, or authentication flows. The CVSS local attack vector (AV:L) and the NVD description referencing 'a local user' indicate the log files are accessible to non-privileged OS users on the host running the UCD or DevOps Deploy server or agent, rather than requiring application-level authentication. No CPE strings were supplied in the intelligence data, but affected product ranges are explicitly enumerated in the IBM PSIRT advisory.

RemediationAI

Apply the vendor-released fix by upgrading to the patched version identified in the IBM support advisory at https://www.ibm.com/support/pages/node/7277576. Exact fix version numbers were not enumerated in the provided intelligence data and must be confirmed directly from the IBM advisory before upgrading. As a compensating control pending patch application, restrict OS-level read permissions on the IBM UCD and DevOps Deploy log directories so that only the application service account and administrators can read them (e.g., chmod 640 or 750 on log directories); be aware that overly restrictive permissions may interfere with centralized log collection agents that run under separate accounts. Additionally, audit existing log files for sensitive content (credentials, tokens, deployment secrets) and rotate any exposed secrets immediately. Centralized log management solutions should be reviewed to ensure log forwarding does not inadvertently broaden exposure of the sensitive log content.