IBM Datacap CVE-2026-9610

Exploitation requires local system access (AV:L per CVSS vector) and high privileges on the host (PR:H per CVSS vector) - meaning the attacker must already be a highly privileged user on the system running IBM Datacap or Datacap Navigator. The attacker must also know or discover the URL paths of the unlisted resources, which are not surfaced in the application UI. These two constraints - local high-privilege access and prior knowledge of hidden URL paths - together significantly limit the realistic attacker population. Limiting factors include: no network-based remote access path; no unauthenticated or low-privilege exploitation path; the vulnerability is entirely absent from CWE scenarios involving privilege escalation, so a successful exploit does not grant the attacker elevated access beyond what they already hold.

The overall risk profile of this vulnerability is very low. The CVSS 3.1 base score of 2.3 is among the lowest possible, driven by a local attack vector (AV:L), high privilege requirement (PR:H), and a ceiling of limited confidentiality impact (C:L) with zero integrity or availability impact. An attacker who could exploit this already holds high-privilege local access to the system - a position from which the incremental exposure from forced browsing is minimal. No EPSS data was provided in the intelligence, but given the constraints (AV:L, PR:H, no public POC, no KEV listing), the real-world exploitation probability is expected to be negligible. There is no evidence of active exploitation. The 'Authentication Bypass' tag in the source intelligence may be misleading in isolation: this is not a full authentication bypass but rather a UI-layer access control bypass for already-authenticated, highly privileged users. Priority for remediation should be low relative to other CVEs; however, patching is advisable as IBM has already made it available.

A local user with high-level privileges on the IBM Datacap host - such as an administrator who should not have access to a specific functional area - identifies an unlinked application URL (for example, through source inspection, error messages, or documentation) and navigates directly to it, bypassing the UI-enforced access restriction to retrieve sensitive application data or invoke hidden functionality. No public proof-of-concept code exists for this vulnerability at the time of analysis.