IBM Planning Analytics CVE-2026-85457

Exploitation requires the attacker to possess valid low-privilege credentials for an IBM Planning Analytics 2.0 or 2.1 instance (CVSS PR:L), after which no user interaction is needed and the flaw is reachable over the network against affected versions. The limiting factors are the authentication requirement - an unauthenticated outsider cannot trigger it directly - and version scope: only Planning Analytics 2.0 and 2.1 are named. The description does not specify a particular feature, protocol, or non-default configuration gate, so it should be treated as exploitable against standard authenticated deployments of these versions until IBM's advisory (node 7291604) clarifies otherwise.

This is a credible, high-priority vulnerability but not an emergency-tier one based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, which is a realistic profile for an internally-exploitable RCE. The base score of 8.1 is driven by C:H/I:H with A:N - note that A:N is unusual for a stack-based buffer overflow yielding arbitrary code execution, since memory-corruption RCE typically also permits service crashes/availability loss; this suggests the vendor scored conservatively and real availability impact may be higher (verify with IBM). No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; the absence of these is not evidence of low risk, only of limited telemetry. Because PR:L requires valid (if low-privilege) credentials, this is primarily a privilege-escalation-to-RCE risk for environments where many users hold Planning Analytics accounts rather than a mass-internet-exploitable issue. Overall: a real priority to patch for IBM Planning Analytics operators, tempered by the authentication requirement and the lack of any confirmed active exploitation.

An attacker who already holds a low-privilege but valid Planning Analytics account sends a crafted request over the network to a vulnerable 2.0 or 2.1 instance, overflowing a fixed-size stack buffer in the server-side parsing path. The corrupted stack is leveraged to execute attacker-controlled code in the context of the Planning Analytics service, yielding full confidentiality and integrity compromise. No public exploit identified at time of analysis, and no user interaction is required.