IBM Planning Analytics CVE-2026-75061

Exploitation requires a network-reachable IBM Planning Analytics 2.0 or 2.1 instance that processes HTTP URL requests; the attacker needs only to submit a crafted URL containing '/../' ('dot dot') traversal sequences - no authentication (PR:N), no user interaction (UI:N), and no non-default configuration are stated as prerequisites, so default deployments appear affected. The primary limiting factors are version (only 2.0 and 2.1 are listed) and network exposure of the application endpoint; organizations that have applied the IBM patch from support node 7291604 or that restrict network access to the service materially reduce exploitability.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, score 7.5) describes a remotely reachable, low-complexity, unauthenticated path traversal that permits arbitrary file WRITE (I:H) with no confidentiality or availability impact. The signals are internally consistent - network vector matches the 'specially crafted URL request' described, and PR:N matches an attack requiring no credentials. However, several real-risk indicators are MISSING from the input: no EPSS exploitation-probability score is provided, the vulnerability is NOT in CISA KEV, and no public POC is referenced - so there is no public exploit identified at time of analysis. The practical danger is understated by the I-only scoring: arbitrary unauthenticated file write on a server commonly leads to code execution (e.g., writing a web shell or overwriting a config/binary), which would in reality escalate confidentiality and availability impact beyond the scored I:H. On balance this is a genuine priority for IBM Planning Analytics operators - low attack complexity, no authentication, and a vendor patch already available - rather than a high-CVSS-but-low-real-risk issue, though the absence of EPSS/KEV/POC data suggests exploitation is not yet known to be widespread.

A remote, unauthenticated attacker sends a specially crafted HTTP request to an internet- or network-exposed IBM Planning Analytics server with '/../' dot-dot sequences in the URL path, causing the application to write an attacker-controlled file outside the intended directory. By placing a malicious file (such as a script or web shell) in a web-served or startup location, the attacker can pivot from file write toward code execution. No public exploit code is identified at time of analysis, but the low complexity (AC:L) and lack of required authentication (PR:N) make reliable exploitation straightforward once the write primitive is understood.