What is the CVSS score of CVE-2026-5065?

CVE-2026-5065 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of IBM Controller are affected by CVE-2026-5065?

IBM Controller versions 11.0.1 through 11.1.2 contain hard-coded credentials that are identical across all deployments, creating a critical insider threat vector.

How to fix or mitigate CVE-2026-5065?

Within 24 hours: Identify and catalog all IBM Controller instances running versions 11.0.1, 11.1.0, 11.1.1, or 11.1.2 and assess their criticality. Within 7 days: Restrict network access to affected controllers to authorized personnel only; enable comprehensive logging for all controller access and administrative actions; minimize low-privilege account permissions. Within 30 days: Monitor IBM security advisories for patch availability; develop and test upgrade strategy in non-production environment; evaluate alternative controller products as contingency.

IBM Controller CVE-2026-5065

EUVD-2026-32423 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-05-27 psirt@us.ibm.com

GHSA-ww96-hf4g-fqcq

Authentication Bypass IBM

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:16 vuln.today

DescriptionCVE.org

IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

AnalysisAI

Hard-coded credentials in IBM Controller (versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2) give attackers a static, embedded secret - a password or cryptographic key - that the product uses for inbound authentication, outbound communication, or encryption of internal data. Because the credential is the same across every deployment, an attacker who already holds low-level access (CVSS PR:L) can leverage it to gain full confidentiality, integrity, and availability impact (C:H/I:H/A:H) over the network. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

IBM Controller (IBM Cognos Controller) is an enterprise financial consolidation, close, and reporting application typically deployed inside corporate finance environments and integrated with databases and external reporting components. The root cause is CWE-798 (Use of Hard-coded Credentials): a secret value is compiled into or shipped with the product rather than generated per-installation, so it is identical for all customers and recoverable by anyone who can inspect the binaries, configuration, or traffic. Per the vendor description the credential is used for one or more of inbound authentication, outbound communication to external components, or encryption of internal data - meaning the same flaw could enable impersonation of a trusted account, interception/spoofing of component-to-component traffic, or decryption of data protected by a known key. No CPE strings were supplied beyond the version identifiers, so exact platform/edition scoping should be confirmed against the IBM advisory.

RemediationAI

Apply the fix described in the IBM Support advisory at https://www.ibm.com/support/pages/node/7273004; a patch is available per vendor advisory, but the exact fixed version/build is not stated in the data provided here and must be taken directly from that advisory rather than assumed. Because the credential is static and shared, simply patching may not be sufficient if the secret was already exposed - after upgrading, rotate or revoke any credentials, keys, or service accounts associated with Controller's inbound authentication and outbound integrations where the product supports it. As compensating controls until patched: restrict network access to the Controller server and its component/database listeners to only trusted finance hosts via firewall/segmentation (trade-off: may break legitimate integrations that must be re-permitted), and increase monitoring/logging of authentication and inter-component traffic to detect use of the embedded account (trade-off: detective only, does not prevent abuse). Confirm the precise fixed build with IBM before deploying.