IBM Planning Analytics CVE-2026-13365

Exploitation requires that the target user holds an active authenticated session in IBM Planning Analytics 2.0 or 2.1 Local at the moment they visit the attacker-controlled page (UI:R per CVSS). The attacker themselves requires no credentials or privileges (PR:N). The targeted Planning Analytics endpoint must accept state-changing requests without adequate CSRF token validation. Limiting factors: the victim's session must not have expired; browsers enforcing SameSite=Strict cookie policy will block the cross-origin credential forwarding; network perimeter controls restricting Planning Analytics access to internal IPs significantly reduce the attacker's ability to host reachable malicious pages or to reach the target application.

The CVSS 7.1 (High) score reflects high integrity impact (I:H) and low availability impact (A:L) with no confidentiality exposure. Attack vector is network (AV:N), complexity is low (AC:L), and no attacker privileges are required (PR:N), but user interaction is mandatory (UI:R) - a meaningful real-world constraint. Successful exploitation requires social engineering an authenticated Planning Analytics user, making mass-scale automated attacks unlikely. No EPSS score was provided, and this CVE is absent from the CISA KEV catalog, reinforcing that exploitation is not confirmed as widespread or opportunistic. The 'Local' product designation suggests on-premises deployments that may benefit from perimeter network controls, further reducing realistic exposure. Overall, this is a genuine high-severity risk for targeted attacks against specific authenticated users, but not a fire-drill priority absent evidence of active exploitation.

An attacker crafts a malicious webpage containing a hidden HTML form auto-submitted via JavaScript, targeting a sensitive Planning Analytics endpoint such as modifying a financial plan or changing user settings. The attacker delivers this page to an authenticated Planning Analytics user via a phishing email; when the user's browser loads the page, it silently submits the forged request with the victim's active session cookie, causing the server to execute the unauthorized action as if the user had initiated it. No public exploit code has been identified at time of analysis.