What is the CVSS score of CVE-2026-9610?

CVE-2026-9610 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-9610?

Yes, a patch is available for CVE-2026-9610. Update the affected software to the latest version immediately.

IBM Datacap CVE-2026-9610

EUVD-2026-38287 MEDIUM

Direct Request ('Forced Browsing') (CWE-425)

2026-06-22 ibm

GHSA-gc5m-j868-gqpq

IBM Authentication Bypass Datacap Datacap Navigator

5.3

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

LOW

qualitative

NVD

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

2.3 LOW

Local attack vector and high privileges required because exploitation needs both host-level access and existing elevated credentials; only limited confidentiality impact applies with no integrity or availability effect.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jun 26, 2026 - 21:22 NVD

LOW MEDIUM

CVSS changed

Jun 26, 2026 - 21:22 NVD

2.3 (LOW) 5.3 (MEDIUM)

Analysis Generated

Jun 22, 2026 - 16:07 vuln.today

DescriptionNVD

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked in the UI but is accessible by directly requesting the URL, bypassing intended access controls.

AnalysisAI

Forced browsing exposure in IBM Datacap and IBM Datacap Navigator 9.1.7 through 9.1.9 allows a highly privileged local user to access application resources and functionality not surfaced in the UI by constructing direct URL requests, bypassing the intended UI-driven access control model. The impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability consequence, and no exploitation has been confirmed - no public exploit code exists and this CVE is absent from the CISA KEV catalog. IBM has released a patch addressing all affected versions.

Technical ContextAI

The root cause is CWE-425 (Direct Request / Forced Browsing), a class of vulnerability in which an application restricts functionality through UI omission - hiding links or menu items - rather than through server-side authorization checks. When a user crafts a direct HTTP or file-system path request to an unlinked endpoint, the application serves it without validating whether the requestor is permitted to access it. IBM Datacap is an enterprise document capture and processing platform; IBM Datacap Navigator is its companion UI component. Both are identified by CPE strings cpe:2.3:a:ibm:datacap and cpe:2.3:a:ibm:datacap_navigator, with the vulnerability spanning versions 9.1.7, 9.1.8, and 9.1.9. The CVSS vector AV:L reflects that exploitation occurs in a local access context, consistent with an installed application or a server component accessible only from the host itself.

RemediationAI

IBM has released a patch addressing this vulnerability; the exact fixed version should be confirmed at the IBM support advisory located at https://www.ibm.com/support/pages/node/7276609. Organizations running IBM Datacap or IBM Datacap Navigator 9.1.7, 9.1.8, or 9.1.9 should apply the vendor-supplied update as the primary remediation. If patching is temporarily deferred, a compensating control is to implement server-side authorization checks or URL-based access control rules at the web server or application gateway layer to block direct access to unlisted endpoint paths - this adds defense-in-depth but may affect legitimate application behavior and should be tested before deployment. Given that exploitation requires high-privilege local access, restricting local OS-level access to the Datacap host to only authorized administrators also reduces the attack surface.