IBM Planning Analytics CVE-2026-19627

Exploitation requires network access to an IBM Planning Analytics 2.0 or 2.1 instance whose request handling performs improper file-path validation; the attacker supplies crafted file paths (directory traversal) to read arbitrary host files and overwrite certain application files. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, no user interaction, and no special preconditions are stated, so default reachable deployments are affected. The primary limiting factors are network exposure of the Planning Analytics service (instances restricted to internal/segmented networks or behind authentication proxies reduce reach) and running an unpatched 2.0/2.1 version - applying the IBM fix removes the condition. Integrity impact is limited (I:L) to 'certain application files' rather than arbitrary write.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, base 8.2) indicates a network-reachable, low-complexity path traversal requiring no authentication or user interaction, which is a genuinely favorable profile for an attacker and consistent with the CWE-22 classification and the description's 'remote attacker' language. However, the real-world risk signals are sparse: no EPSS probability was supplied, there is no CISA KEV listing, and no public proof-of-concept is referenced, so there is currently no evidence of active or widespread exploitation. The one strong mitigating fact is that IBM has published a patch (node/7291604), meaning defenders have a concrete remediation path. On balance this is a credible, prioritize-and-patch issue for IBM Planning Analytics operators rather than a confirmed emergency - the high CVSS is driven by unauthenticated network reach plus high confidentiality impact (arbitrary host file read), but the absence of EPSS/KEV/POC data means the likelihood of imminent exploitation cannot be quantified from the inputs and should be treated as unknown, not low.

A remote, unauthenticated attacker sends a crafted request containing directory-traversal sequences to an exposed IBM Planning Analytics endpoint, causing the server's improper path validation to read sensitive host files (e.g., configuration or credential files) outside the intended directory. The same flaw also permits overwriting certain application files, enabling limited tampering with application behavior. No public exploit code is referenced, and the low attack complexity (AC:L) means a working exploit would be straightforward to develop once the vulnerable parameter is identified.