IBM SevOne NPM CVE-2026-96146

The target must be a reachable instance of IBM SevOne Network Performance Management in the 7.0.0 through 8.2.2 version range, exposed to the attacker over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are required - exploitation works against a network-reachable default deployment. The primary limiting factors are network reachability (the attacker needs a path to the SevOne service, which in many deployments is internal-only management network rather than internet-facing) and the version constraint (instances already updated to the vendor-fixed release are not affected). Impact is confined to availability; there is no confidentiality or integrity consequence. The exact resource exhausted and the precise request that triggers it are not described in the available sources.

All signals point to a moderate-severity availability issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no privileges or user interaction required, and an availability-only impact (C:N/I:N/A:H, scope unchanged) - consistent with the CWE-400 uncontrolled resource consumption / denial-of-service classification. The vuln.today decision label is 'this_week', indicating patch-within-the-week priority rather than act_now or emergency. No KEV listing is present, so there is no confirmed active exploitation; no EPSS probability is supplied in the input, so exploitation likelihood cannot be quantified from this data; and no public exploit or PoC reference is provided. The signals are internally consistent: a remotely triggerable DoS that is easy to attempt but limited to availability (no data exposure or code execution). Net read: a genuine but bounded priority - worth patching promptly for internet- or network-exposed SevOne instances, but not a high-CVSS-masking-low-risk case nor a confirmed-exploited emergency. Missing data to note explicitly: EPSS score absent, so widespread-vs-targeted exploitation cannot be judged; and the exact resource exhausted (CPU, memory, connections, disk) is not described in the available sources.

A remote, unauthenticated attacker with network access to a SevOne Network Performance Management instance sends crafted or high-volume requests that trigger uncontrolled resource consumption, exhausting a system resource and rendering the monitoring platform unavailable. Given AV:N/AC:L/PR:N/UI:N, the attempt requires no credentials, no user interaction, and low complexity. No public exploit identified at time of analysis.