IBM UrbanCode Deploy CVE-2026-12086

Exploitation requires local OS-level access to the host running IBM UrbanCode Deploy or IBM DevOps Deploy server or agent components. The CVSS vector PR:N indicates that no special application or OS privilege is needed beyond having a local user session, meaning log files appear to be readable by non-privileged OS accounts. Exploitation is limited to versions within the specified ranges (UrbanCode Deploy 7.2-7.2.3.23, 7.3-7.3.2.18; DevOps Deploy 8.0-8.0.1.13, 8.1-8.1.2.6, 8.2-8.2.1.0). Remote network access alone is insufficient - the attacker must have an interactive or scripted local session. The specific log file paths and the exact type of sensitive data logged are not enumerated in the available intelligence, so the precise deployment activities that trigger sensitive log writes are not independently confirmed.

The CVSS 3.1 base score of 6.2 (Medium) is driven by a local attack vector, low complexity, no required privileges, no user interaction, and high confidentiality impact with no integrity or availability impact - vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The PR:N rating is notable: it implies log files are readable without any special OS or application privileges, which increases the realistic attack surface to any user with a shell account on the deployment host. No EPSS data was provided, no KEV listing exists, and no public POC has been identified at time of analysis. Real-world priority is moderate: exploitation is trivially simple (file read) for anyone with local access, but requires physical or remote shell presence on the server or agent host. In enterprise environments running UCD or DevOps Deploy, these hosts often hold deployment credentials for downstream systems, making the confidentiality impact higher in practice than the CVSS scope-unchanged rating implies. The absence of a network attack vector limits exposure compared to remotely exploitable flaws, but insider threat and post-compromise scenarios are realistic.

An attacker who has obtained a low-privilege shell account on a host running IBM UrbanCode Deploy or DevOps Deploy - whether through credential theft, lateral movement from another compromised system, or insider access - navigates to the application log directory and reads log files to extract embedded credentials, API tokens, or deployment secrets logged during pipeline execution. No exploit tooling is required; standard OS file-read commands are sufficient. These extracted secrets can then be used to pivot to downstream deployment targets, cloud environments, or other systems managed by the deployment platform.