What is the CVSS score of CVE-2026-9836?

CVE-2026-9836 has a contested CVSS base score of 7.5 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of IBM InfoSphere Information Server are affected by CVE-2026-9836?

IBM InfoSphere Information Server (versions 11.7.0.0-11.7.1.6) exposes organizations to unauthenticated remote access to sensitive confidential data, creating a data breach risk across any instance…. A patch is available.

How to fix or mitigate CVE-2026-9836?

Within 24 hours: Identify and catalog all IBM InfoSphere Information Server systems running versions 11.7.0.0 through 11.7.1.6; assess and classify each system by data sensitivity (customer data, intellectual property, regulated information). Within 7 days: Obtain and deploy the vendor-released patch from IBM; prioritize systems with highest data sensitivity; coordinate change control and maintenance scheduling. Within 30 days: Complete patch deployment across all affected systems; verify patch application; analyze access logs for evidence of unauthorized access during the exposure window.

IBM InfoSphere Information Server CVE-2026-9836

EUVD-2026-40378 HIGH

Information Exposure (CWE-200)

2026-06-30 ibm

GHSA-5wpw-59x5-j49f

Information Disclosure IBM Infosphere Information Server

High

Disputed · 7.5 NVD

Severity by source

Sources disagree (Low–High)

Vendor (ibm) PRIMARY

LOW

qualitative

NVD

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated information disclosure with no user interaction (AV:N/AC:L/PR:N/UI:N); confidentiality-only impact (C:H, I:N, A:N) consistent with CWE-200.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 02, 2026 - 19:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 19:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 19:37 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 19:37 NVD

LOW HIGH

CVSS changed

Jul 02, 2026 - 19:37 NVD

3.5 (LOW) 7.5 (HIGH)

Analysis Generated

Jun 30, 2026 - 19:50 vuln.today

DescriptionNVD

IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure vulnerability.

AnalysisAI

Information disclosure in IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 allows remote attackers to obtain sensitive information over the network without authentication (CVSS 3.1 vector AV:N/PR:N, base 7.5). The flaw exposes confidential data (C:H) while leaving integrity and availability untouched, and there is no public exploit identified at time of analysis. EPSS is low (0.15%, 5th percentile) and CISA SSVC rates exploitation as none, indicating this is a real but not urgently exploited issue.

Technical ContextAI

IBM InfoSphere Information Server is an enterprise data integration platform used for data profiling, cleansing, ETL (via DataStage), and metadata governance across large data warehouses. The single affected CPE is cpe:2.3:a:ibm:infosphere_information_server, spanning the 11.7.x maintenance line. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a class in which the application returns or leaks data - such as configuration details, internal identifiers, or user/session data - to actors who should not have access, typically through an endpoint or response that fails to enforce proper authorization or output filtering.

RemediationAI

Patch available per vendor advisory: apply the fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7278188, which covers the affected 11.7.0.0-11.7.1.6 range; the exact patched build number is not stated in the available data, so consult that IBM support page for the specific interim fix or fix pack for your version. As a compensating control until patching, restrict network reachability of the Information Server web/services tier to trusted management networks and place it behind a reverse proxy or WAF that can filter or require authentication on the exposed endpoints, accepting that overly broad filtering could interrupt legitimate DataStage or metadata client traffic. Monitor access logs for anomalous requests to information-returning endpoints, and validate the fix against IBM's advisory rather than relying on version inference. Full advisory and CVE detail: https://nvd.nist.gov/vuln/detail/CVE-2026-9836.