EUVD-2026-98078
GHSA-73c5-qf5f-mp9w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Planning Analytics web endpoint
-
DeliverySubmit crafted malformed sub-request
-
ExploitBypass authentication validation
-
ExecutionEscalate to elevated privileges
-
ImpactFull read/write control of application
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | Exploitation requires network reachability to the IBM Planning Analytics (2.0 or 2.1) application interface and the ability to issue a sub-request that the server fails to validate properly (CWE-288, authentication bypass via an alternate path/channel). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are documented as prerequisites - this behaves as remote unauthenticated exploitation against affected versions. The primary limiting factors are: the attacker must be able to reach the Planning Analytics endpoint (network segmentation or not exposing it to untrusted networks significantly reduces exposure), and the affected software must be an unpatched 2.0 or 2.1 install; applying the IBM fix removes the condition entirely. The exact sub-request/feature that is mishandled is not specified in the available data and should be confirmed against the IBM advisory. |
| Impact | Signals conflict and must be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a textbook critical flaw - remote, low-complexity, unauthenticated, with total confidentiality, integrity, and availability impact (9.8) - consistent with an authentication-bypass-plus-privilege-escalation chain (CWE-288). However, the real-world exploitation signals are far cooler: EPSS is only 0.36% (28th percentile), the vulnerability is NOT in CISA KEV, and no public exploit code is identified. CISA's SSVC framework reinforces this, rating Exploitation as 'none' and Automatable as 'no' while confirming Technical Impact is 'total'. In short, the damage potential if exploited is maximal, but there is currently no evidence of exploitation or weaponization. This is a genuine high-priority patch-now item for IBM Planning Analytics operators because of the unauthenticated-to-total-compromise profile and vendor-confirmed patch, but it is not yet an emergency-response (actively-exploited) scenario. The low EPSS and 'Automatable: no' SSVC rating suggest that even if exploited, it would likely be targeted rather than mass/wormable, pending release of exploit details. |
| Exploit ScenarioDerived | A remote attacker who can reach the IBM Planning Analytics web interface sends a crafted sub-request that the server improperly validates, bypassing authentication and then escalating to elevated privileges. From there the attacker reads or alters financial planning data and reconfigures the application. No public proof-of-concept exploit has been identified, and the low attack complexity (AC:L) means no special timing or race conditions are required once the technique is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 15, 2026
Authentication bypass and privilege escalation in IBM Planning Analytics 2.0 and 2.1 allow an unauthenticated remote attacker to reach functionality that should require credentials by abusing improperly validated sub-requests (CWE-288). Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation needs only network reachability to the Planning Analytics application interface - no authentication, no user interaction, and no documented non-default configuration - yielding high confidentiality, integrity, and availability impact, which is why the score is 9.8. Signals conflict and must be weighed carefully: despite the severity and total technical impact under SSVC, EPSS is only 0.36% (28th percentile), CISA SSVC records Exploitation: none, and no public exploit code has been identified at time of analysis, so this should be treated as a serious but not yet observed threat. The vendor has released a fix, so exposure is concentrated in unpatched, internet- or partner-reachable deployments.
Earlier versions of this analysis (1)
Privilege escalation in IBM Planning Analytics 2.0 and 2.1 allows a remote attacker who already holds a low-privilege authenticated session to bypass authorization on improperly validated sub-requests and reach high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U). Because the vendor vector carries PR:L, the flaw is not reachable by a fully anonymous attacker despite the advisory's 'bypass authentication' wording - the attacker must first obtain a valid low-privilege account and have network reachability to the Planning Analytics service, after which no user interaction is required. Exploitation status: no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; an IBM vendor patch is available per the support advisory, so the exposed population is limited to unpatched 2.0 and 2.1 deployments.
RemediationAI
Apply the IBM fix for CVE-2026-19622 as documented in the vendor advisory at https://www.ibm.com/support/pages/node/7291604 - patch availability is confirmed by the vendor, but the supplied data does not name an exact fix-pack version, so read the advisory to identify the correct release for your 2.0 or 2.1 installation and upgrade to at least that level before re-exposing the service. Where immediate patching is not possible, the highest-value compensating control is reducing reachability: place the Planning Analytics web/REST interface behind network segmentation, VPN, or an authenticated reverse proxy so only trusted users and networks can issue requests, accepting the trade-off of reduced accessibility for distributed or external users. Additionally, restrict or monitor any endpoint that proxies, forwards, or internally composes sub-requests (including administrative paths) at the WAF or gateway, since CWE-288 exploits surface as requests whose authorization context changes mid-chain; the trade-off is potential false positives on legitimate composite API traffic and possible breakage of integrations if paths are blocked outright. Log and alert on unauthenticated requests that reach privileged or administrative functionality, and rotate credentials or review audit logs for the affected window if compromise is suspected. Do not rely on obscurity of the sub-request endpoint as a control, and note that no public exploit code has been identified at time of analysis, so proactive patching - not emergency incident response - is the appropriate posture.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-288, Authentication Bypass Using an Alternate Path or Channel: the application enforces authentication on its primary request path but fails to re-validate the caller's identity when a request triggers a secondary, internal, or forwarded sub-request, so an attacker can supply or manipulate that sub-request to reach privileged operations directly. IBM Planning Analytics is the TM1-based planning, budgeting, and analytics platform whose web tier and REST/API layer broker calls into the in-memory OLAP engine and administrative services; that brokering is precisely where sub-request validation matters. The CPE cpe:2.3:a:ibm:planning_analytics:*:*:*:*:*:*:*:* uses a wildcard version, so all 2.0 and 2.1 builds are treated as potentially affected (EUVD-2026-98078 lists Planning Analytics 2.1 and 2.0), but the advisory at https://www.ibm.com/support/pages/node/7291604 should be consulted to confirm which fix-pack levels contain the faulty validation. Because the bypass grants the privileges of whatever internal context the sub-request is executed under, impact is not limited to read access - integrity and availability are also rated High. The exact feature or endpoint that mishandles the sub-request is not specified in the available data and must be confirmed against the vendor advisory before building detection logic.
Know when Planning Analytics gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Authentication bypass over the network with no privileges or interaction (AV:N/AC:L/PR:N/UI:N), yielding full privilege escalation and total impact (C:H/I:H/A:H); scope unchanged within the application.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
Executive ViewAI
IBM Planning Analytics 2.0 and 2.1 contain a critical authentication-bypass flaw that could allow an unauthenticated remote attacker to reach protected planning functionality, potentially exposing or altering sensitive financial and operational data and disrupting availability. No public exploit identified at time of analysis and no exploitation has been observed, but the issue is remotely reachable with high confidentiality, integrity, and availability impact, so unpatched internet- or partner-facing instances carry material business risk. Leadership should prioritize remediation because these systems often support business-critical planning cycles and sensitive forecasts.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Planning Analytics
View allIBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated use
IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validat
Improper authentication in IBM Planning Analytics 2.0 and 2.1 allows an attacker who already holds valid low-privilege c
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Rated high severity (CVSS 8.
Path traversal in IBM Planning Analytics 2.0 and 2.1 allows a remote attacker to read arbitrary files from the host and
Authenticated remote code execution in IBM Planning Analytics 2.0 and 2.1 stems from a stack-based buffer overflow (CWE-
IBM Planning Analytics 2.0 is vulnerable to a Remote File Include (RFI) attack. Rated high severity (CVSS 7.8), this vul
IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. Rated high severity (CVSS 7.8), this vulnerabilit
Arbitrary file write via path traversal in IBM Planning Analytics 2.0 and 2.1 allows remote unauthenticated attackers to
IBM Planning Analytics 2.0 is vulnerable to server-side request forgery (SSRF). Rated high severity (CVSS 7.3), this vul
Authenticated low-privileged users on IBM Planning Analytics 2.0 and 2.1 can delete folders and applications belonging t
Cross-site request forgery in IBM Planning Analytics 2.0 and 2.1 Local enables network-based attackers to force authenti
Exploit-DB