What is the CVSS score of CVE-2026-2713?

CVE-2026-2713 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of IBM are affected by CVE-2026-2713?

IBM Trusteer Rapport 3.5.2309.290 contains a critical local privilege escalation vulnerability that allows attackers with local system access to execute arbitrary code.

How to fix or mitigate CVE-2026-2713?

Within 24 hours: Inventory all systems running IBM Trusteer Rapport 3.5.2309.290 and assess exposure in your environment. Within 7 days: Implement application whitelisting on affected systems and restrict local administrative access where possible. Within 30 days: Contact IBM for patch availability timeline and prepare upgrade plan; consider temporary uninstallation if risk assessment indicates high exposure and alternative endpoint protection exists.

IBM CVE-2026-2713

HIGH

Uncontrolled Search Path Element (CWE-427)

2026-03-10 psirt@us.ibm.com

IBM RCE

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 20:16 nvd

HIGH 7.4

DescriptionCVE.org

IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontrolled search path element vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system.

AnalysisAI

IBM Trusteer Rapport 3.5.2309.290 contains an insecure DLL search path vulnerability that allows local attackers to execute arbitrary code by planting a malicious file in a compromised directory. The attack requires local system access but no user interaction or elevated privileges, making it exploitable by any local user. No patch is currently available for this high-severity vulnerability.

Technical ContextAI

Classified as CWE-427 (Uncontrolled Search Path Element). IBM Trusteer Rapport installer 3.5.2309.290 IBM Trusteer Rapport could allow a local attacker to execute arbitrary code on the system, caused by DLL uncontrolled search path element vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system.