EUVD-2026-38283
GHSA-xfpj-q55p-7h2m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to Datacap host/process
-
DeliveryRead process memory
-
ExploitExtract cleartext passwords and crypto key
-
ExecutionDecrypt stored credential store
-
PersistAuthenticate to application
-
ImpactAccess sensitive database data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V14 - Data Protection Memory data protection
|
| Exploitation Conditions | Exploitation requires the attacker to be able to read the memory of the running IBM Datacap / Datacap Navigator process where passwords and the cryptographic key are held in cleartext (CWE-316); recovering the key is the prerequisite that then enables decrypting stored passwords, authenticating to the application, and reaching the database. Limiting factors: the published CVSS vector states PR:N/UI:N (no authentication, no user interaction), but the weakness class (in-memory disclosure) typically implies local or privileged host access - this network-vector-versus-memory-read discrepancy is unresolved in the available data and should be confirmed with IBM. Only the 9.1.7, 9.1.8, and 9.1.9 release lines of either product are affected. |
| Impact | Signals here conflict and should be read carefully. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), implying remote, unauthenticated, no-interaction confidentiality compromise - yet the description is a memory-disclosure / cleartext-in-memory weakness (CWE-316), which in practice normally requires local or privileged access to read process memory, not a clean network path. This network-vector-versus-memory-read mismatch should be verified with IBM before treating it as a remote unauthenticated bug. Corroborating the lower-urgency reading: EPSS is 0.08% (0th percentile), CISA SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial, and no POC or KEV listing exists. Net assessment: a real confidentiality weakness worth patching on a normal maintenance cadence, but not an emergency - the high CVSS base score overstates real-world exploitability relative to EPSS and SSVC. |
| Exploit ScenarioDerived | An attacker who can read the Datacap process memory (e.g., a local or low-privileged user on the application host, or via a separate foothold) dumps the running process, extracts the cleartext passwords and the cryptographic key, then uses that key to decrypt the stored credential store. With valid application credentials they log in and query the backend database for sensitive captured documents and data. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 26, 2026
Sensitive-data disclosure in IBM Datacap and Datacap Navigator (versions 9.1.7, 9.1.8, 9.1.9) lets an attacker recover user passwords and cryptographic keys that the application holds in cleartext in memory; the recovered keys can then decrypt stored credentials, authenticate to the application, and reach sensitive data in the backing database. IBM has released a patch. There is no public exploit identified at time of analysis, EPSS exploitation probability is negligible (0.08%, 0th percentile), and CISA SSVC rates exploitation as 'none' - indicating low immediate field risk despite the high CVSS confidentiality impact.
Earlier versions of this analysis (2)
Sensitive information disclosure in IBM Datacap and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes user passwords and cryptographic keys held in process memory, letting an attacker reuse those keys to decrypt stored credentials, authenticate to the application, and reach sensitive data in the backing database. The flaw scores CVSS 7.5 (confidentiality-only) and was reported by IBM with a patch available; there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.08%.
IBM Datacap and IBM Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9 expose user passwords and cryptographic keys in cleartext within process memory, enabling a local low-privileged attacker to extract and weaponize those credentials. The extracted keys can be used to decrypt additional protected secrets, impersonate users, and gain unauthorized access to sensitive data stored in backend databases. No public exploit or KEV listing is identified at time of analysis, but the chained impact - from memory read to full database access - elevates practical severity beyond the base CVSS score of 5.5 suggests.
RemediationAI
Apply the IBM-released fix per the vendor advisory at https://www.ibm.com/support/pages/node/7276609 (Patch available per vendor advisory; the advisory enumerates the fixed fix-pack levels above the vulnerable 9.1.7 ≤1.8.4 and Navigator 9.1.7 ≤8.2.1.0 builds - confirm the exact target build from that page rather than an assumed version number). Until the patch is deployed, reduce exposure of the credential/key material: restrict and monitor administrative and local access to the Datacap application servers so process memory cannot be read by unprivileged users, segment the Datacap and Navigator hosts away from general user networks, and rotate any application passwords and cryptographic keys after patching since pre-patch keys may already be compromised. Note the trade-off that host-access restrictions and network segmentation limit operator convenience and remote administration but do not themselves remove the in-memory exposure - only the vendor patch does that.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Datacap is an enterprise document/data-capture platform and Datacap Navigator is its web client. The root cause maps to CWE-316 (Cleartext Storage of Sensitive Information in Memory): the process retains passwords and the cryptographic key material used to protect them in an unprotected, recoverable form within process memory rather than zeroizing or encrypting it. Because the same key that protects stored passwords is exposed, an attacker who reads that memory can reverse the protection scheme, decrypt credential stores, and laterally access the application database. Affected packages per CPE are cpe:2.3:a:ibm:datacap and cpe:2.3:a:ibm:datacap_navigator (all version fields wildcard in NVD CPE, with EUVD constraining to the 9.1.7-9.1.9 lines).
Know when Datacap gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Reading cleartext secrets from process memory realistically needs local, low-privileged host access (AV:L, PR:L); impact is confidentiality-only (C:H, I:N, A:N) with no scope change.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database.
Executive ViewAI
IBM Datacap and Datacap Navigator versions 9.1.7-9.1.9 contain a memory disclosure vulnerability that exposes plaintext passwords and encryption keys, enabling credential theft and downstream unauthorized access to sensitive databases; while active exploitation remains unlikely per EPSS and no public exploit exists, the patch is available and deployment is essential to eliminate the credential exposure pathway.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper v
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that coul
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that cou
Insecure direct object reference in DataCap (the MetaForge data platform) through 2025.1.1 allows any authenticated, low
Cross-site scripting in IBM Datacap and Datacap Navigator 9.1.7 through 9.1.9 allows unauthenticated remote attackers to
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be rea
IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim.
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By pe
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. Rated medium severity
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to stored cross-site scripting. Rated medium s
Forced browsing exposure in IBM Datacap and IBM Datacap Navigator 9.1.7 through 9.1.9 allows a highly privileged local u
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to traverse directories on the
Exploit-DB