EUVD-2026-71601
GHSA-pqx8-h6gr-6xwr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) that escalates to web-shell RCE gives full C:H/I:H/A:H; scope kept U as impact stays within the app/DB security authority.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
2DescriptionCVE.org
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
AnalysisAI
SQL injection in IBM Operational Decision Manager (versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0) lets a remote unauthenticated attacker inject arbitrary SQL statements and abuse database write functionality to drop a web shell into the application web root, escalating a data-access flaw into full remote code execution. The CVSS 9.8 rating reflects unauthenticated network reach with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to an affected IBM ODM web-facing component (Decision Center / Decision Server / Rule Execution Server) running one of the listed versions (8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, 9.6.0.0); no authentication, credentials, or user interaction are needed (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-impact case: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a remotely reachable, low-complexity, unauthenticated flaw, and the described chain from SQLi to web-shell RCE means an attacker gains code execution rather than mere data disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix from the IBM security advisory at https://www.ibm.com/support/pages/node/7286196 - consult that bulletin for the exact interim fix / iFix or upgraded version corresponding to your deployed release, as no single fixed version string is provided in the input data (patch available per vendor advisory; exact fix version not restated here to avoid inventing a number). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all IBM Operational Decision Manager deployments running versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, or 9.6.0.0, and immediately restrict network access to these systems to authorized internal users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today