EUVD-2026-98080
GHSA-h4vg-j58m-p5qp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryInject JavaScript into stored Web UI field
-
ExploitVictim loads affected page
-
ExecutionScript executes in trusted session
-
ImpactExfiltrate credentials/session data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to hold a valid authenticated account on the Planning Analytics Web UI (PR:L) and the ability to submit input into a field that is persistently stored and later rendered to other users. The payload only achieves impact when a second user - ideally a higher-privileged one - views the page containing the injected script, so a victim viewing the affected Web UI content is the practical trigger. Limiting factors: the required pre-existing authentication excludes anonymous internet attackers, impact is confined to Low confidentiality/integrity within the browser session (no server-side code execution or availability loss), and only versions 2.0 and 2.1 are listed as affected. |
| Impact | This is a moderate-severity stored cross-site scripting flaw (CVSS 6.4) in IBM Planning Analytics 2.0 and 2.1, with no EPSS score, KEV listing, or public POC provided in the input, so it rates as 'no public exploit identified at time of analysis'. The provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates a network-reachable, low-complexity attack that requires an authenticated user (PR:L) and crosses a security scope (S:C), with only Low confidentiality and integrity impact and no availability impact - consistent with stored XSS where injected script runs in another user's trusted session. One signal is in tension: the vendor-supplied vector sets UI:N, yet stored XSS payloads normally execute only when a victim loads the affected Web UI page, which typically warrants UI:R; verify victim-interaction assumptions with IBM. The authenticated-user prerequisite (an attacker must already have a valid, likely low-privilege account) materially lowers real-world urgency compared to an unauthenticated web flaw, making this a genuine but not emergency-priority issue - appropriate for routine patching rather than drop-everything response, absent any evidence of exploitation. |
| Exploit ScenarioDerived | An authenticated low-privilege user stores a malicious JavaScript payload in a Planning Analytics Web UI field that is later rendered to other users. When an administrator or another user views the affected view, the script executes in their trusted session, enabling theft of session credentials or manipulation of displayed functionality. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Stored cross-site scripting in IBM Planning Analytics 2.0 and 2.1 allows an authenticated user holding a valid account on the Web UI to persist arbitrary JavaScript into a stored field, which then executes in the browser of any other user who views that content - potentially disclosing credentials or session data within a trusted session. Per the assessed vector (CVSS 6.4, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation requires both the attacker's existing authenticated access and a second victim user viewing the affected page, and impact is bounded to low confidentiality and integrity within the browser session rather than server-side code execution or availability loss. There is no public exploit code, no CISA KEV listing, and no EPSS score in the available intelligence, so the flaw rates as 'no public exploit identified at time of analysis'.
RemediationAI
IBM reports a vendor-available patch, so the primary action is to apply the fix published for this issue through the IBM support page at https://www.ibm.com/support/pages/node/7291604 and confirm the exact fixed level or APAR for each installed 2.0 and 2.1 deployment before upgrading - the input data confirms patch availability but does not specify a version number, so do not assume a particular build is remediated without verifying against IBM's advisory. Until upgrades complete, compensating controls should target both the write and the render paths: restrict authoring privileges in the Web UI so that only trusted, minimal sets of accounts can create or edit the stored fields that flow into shared views, recognizing this reduces collaboration functionality for affected teams; deploy a Content-Security-Policy on the Planning Analytics front end that disallows inline and third-party script execution, with the trade-off that legitimate custom UI content may break and will need testing; and mandate re-authentication plus short session lifetimes for privileged reviewers so that a harvested session has limited value. Because exploitation depends on a victim viewing the injected content (UI:R), alerting users and administrators to treat unexpected UI changes or prompts as suspicious and enabling script-blocking browser extensions provides marginal defense in depth, but it does not remove the underlying defect and is not a substitute for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored/persistent variant: user-supplied input is written to a backend store and later rendered into the Planning Analytics Web UI without adequate contextual output encoding or sanitization. Because the payload survives across sessions and is served from the application's own origin, it runs with the trust of the Planning Analytics domain, which is why the assessed vector carries Scope:Changed (S:C) - the injected script crosses the boundary from the application into the victim's browser context. The scope change, combined with Low confidentiality and Low integrity impact, reflects script-level abuse (DOM manipulation, form/credential harvesting, forged UI actions) rather than server compromise. The CPE entry cpe:2.3:a:ibm:planning_analytics:*:*:*:*:*:*:*:* identifies IBM Planning Analytics as the affected product family with an unbounded version wildcard, while the advisory text narrows the vulnerable releases to 2.0 and 2.1. The CVSS input provided in the source data lists UI:N, but the authoritative independent assessment refines this to UI:R, correctly modeling that a victim must view the stored payload before any impact occurs; the private/low-privilege access requirement (PR:L) reflects that only authenticated users can write to the affected Web UI fields.
Know when Planning Analytics gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-reachable Web UI with low-privilege auth (PR:L); stored payload executes only when a victim loads the page (UI:R); script runs in the victim's session so scope changes (S:C) with Low C/I and no availability impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Planning Analytics
View allIBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use
Authentication bypass and privilege escalation in IBM Planning Analytics 2.0 and 2.1 allow an unauthenticated remote att
IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validat
Improper authentication in IBM Planning Analytics 2.0 and 2.1 allows an attacker who already holds valid low-privilege c
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Rated high severity (CVSS 8.
Path traversal in IBM Planning Analytics 2.0 and 2.1 allows a remote attacker to read arbitrary files from the host and
Authenticated remote code execution in IBM Planning Analytics 2.0 and 2.1 stems from a stack-based buffer overflow (CWE-
IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. Rated high severity (CVSS 7.8), this vul
IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. Rated high severity (CVSS 7.8), this vulnerabilit
Arbitrary file write via path traversal in IBM Planning Analytics 2.0 and 2.1 allows remote unauthenticated attackers to
IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). Rated high severity (CVSS 7.3), this vul
Authenticated low-privileged users on IBM Planning Analytics 2.0 and 2.1 can delete folders and applications belonging t
Exploit-DB