IBM Platform RTM CVE-2026-17619

Exploitation requires network access to the IBM Platform RTM web/reporting interface and a request parameter that flows unsanitized into a back-end SQL query. The vendor vector indicates PR:N/UI:N (no authentication or user interaction), so against an exposed default deployment a remote attacker could exploit it directly; however, Platform RTM is typically deployed inside HPC/LSF cluster management networks rather than internet-facing, which is the primary real-world limiting factor. The description does not name the specific vulnerable parameter or page, and it does not confirm whether the endpoint sits behind a login, so verify authentication placement against the IBM advisory before assuming fully pre-auth reachability.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, 8.6 HIGH) describes a network-reachable, low-complexity, unauthenticated SQL injection - a genuinely serious combination on paper. However, no EPSS score, no CISA KEV listing, and no public POC were provided, so the current status is 'no public exploit identified at time of analysis.' There is no SSVC data supplied. The high-CVSS signal is therefore not corroborated by any real-world exploitation evidence, and the true priority is tempered by the affected product's very narrow deployment footprint (IBM Platform RTM, an HPC/Spectrum LSF cluster-monitoring dashboard). One internal inconsistency is worth flagging: the description says an attacker could 'view, add, modify, or delete information in the back-end database' - a full read/write compromise that would normally justify C:H/I:H, yet the vendor rated integrity and availability only Low (I:L/A:L); the impact metrics appear understated relative to the described capability. Also note PR:N (unauthenticated) is asserted by the vendor vector but the description does not itself state whether the injectable endpoint is pre- or post-authentication - verify with the IBM advisory. Net: real and patch-worthy for the small population running Platform RTM, but not a broad emergency given niche prevalence and absence of exploitation signals.

A remote attacker who can reach the IBM Platform RTM web interface submits a request containing a crafted SQL fragment in a vulnerable parameter, which is concatenated into a back-end query. Per the CVSS vector this requires no authentication and low complexity, letting the attacker read sensitive cluster/monitoring data and add, alter, or delete database records. No public exploit code or active exploitation has been identified at time of analysis.