IBM Process Mining CVE-2026-93005

Requires an authenticated account on IBM Process Mining (versions 2.0.0 through 2.2.1) with access to a feature that generates email notifications; exploitation consists of invoking that notification path at a rate the application fails to limit (CWE-770). Limiting factors: the attacker must hold valid credentials (PR:L - this is not remote-unauthenticated), and impact is confined to availability (spamming targeted recipients / mail infrastructure) with no confidentiality or integrity effect. Realistic risk is further bounded by whatever external mail gateway throttling or quotas sit in front of the Process Mining mailer, which the CVE does not address.

This is a moderate-severity, lower-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 and shows network-reachable, low-complexity exploitation, but critically requires existing privileges (PR:L) - an attacker must already be an authenticated user of IBM Process Mining. The only impact is availability (C:N/I:N/A:H); there is no confidentiality or integrity exposure, consistent with CWE-770 (missing rate limiting / resource exhaustion). No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is present, so there is no public exploit identified at time of analysis. The vendor-assigned A:H appears generous for a flaw whose concrete effect is email flooding to targeted recipients rather than a full compromise of Process Mining itself - see assessed_cvss_vector for an independent view. The vuln.today decision label of 'this_month' aligns with this signal set: a genuine but non-emergency fix. Net: a real but authenticated, abuse-of-feature DoS, appropriate to remediate on a normal patch cycle, not a drop-everything priority.

An authenticated IBM Process Mining user (versions 2.0.0 through 2.2.1) abuses an email-notification-triggering feature that lacks rate limiting, repeatedly invoking it to generate a flood of notification emails aimed at chosen recipients. Because attack complexity is low (AC:L) and no user interaction is required, the attacker can script the requests to overwhelm victim mailboxes or the mail-sending infrastructure. No public PoC or exploit code is identified in the available data.