IBM Controller CVE-2026-5065

Exploitation requires network reachability to IBM Controller 11.0.1-11.1.2 and, per the CVSS vector (PR:L), some low-level privilege or foothold on the system or network rather than fully unauthenticated access; no user interaction is required (UI:N) and attack complexity is low (AC:L). The concrete prerequisite is knowledge of the static embedded credential that Controller uses for inbound authentication, outbound component communication, or internal-data encryption - once that secret is known, abuse is trivial across any affected install. Limiting factors: the secret must be obtained (from binaries/config/traffic), the Controller endpoints/components must be network-accessible to the attacker, and the version must be in the affected range. Note the unresolved tension between the 'Authentication Bypass' tag and the PR:L rating - verify with IBM whether the credential is exploitable pre-authentication, as that would remove the privilege prerequisite.

The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: network reachable, low attack complexity, no user interaction, and full triad impact, but requiring some level of existing privilege (PR:L). The 'Authentication Bypass' tag is in mild tension with the PR:L rating - hard-coded credentials often enable unauthenticated impersonation (which would warrant PR:N), yet IBM scored this as needing low-level privileges; defenders should verify whether the embedded credential is reachable pre-authentication or only post-authentication, as this materially changes exposure. No EPSS score was provided, so statistical exploitation probability cannot be stated. The CVE is not in CISA KEV and no proof-of-concept was referenced, so this is currently a high-severity-but-unproven-exploitation issue rather than a confirmed active threat; however, hard-coded credential flaws are historically reliable and durable once the secret is published, so prompt patching is warranted. No SSVC decision data was provided.

An attacker with low-level access to a network where IBM Controller is reachable extracts the hard-coded credential from the product (e.g., from binaries, configuration, or observed traffic) and uses it to authenticate as a trusted account or decrypt protected internal data. Leveraging this, they read or tamper with consolidated financial data and disrupt the service, achieving full confidentiality, integrity, and availability impact. No public proof-of-concept is referenced, and exploitation would follow the low-complexity, network-based path described by the CVSS vector.