EUVD-2026-40378
GHSA-5wpw-59x5-j49f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Information Server interface
-
ExploitSend unauthorized request to vulnerable endpoint
-
ExecutionServer returns sensitive information
-
ImpactHarvest disclosed data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation against a network-reachable instance with no user interaction, so the primary prerequisite is simply network access to an affected IBM InfoSphere Information Server (11.7.0.0-11.7.1.6) instance. The description does not name the specific component, endpoint, or feature that leaks data, so the exact request/configuration required cannot be extracted from available data. Limiting factors: the impact is confined to confidentiality (no write or denial of service), CISA SSVC records no known exploitation and no automatability, and the attacker must reach the server's exposed interface - instances isolated to internal management networks are substantially harder to target. |
| Impact | Signals here are mixed and lean toward moderate rather than emergency priority. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an easy, network-reachable, unauthenticated attack, which drives the 7.5 base score, but the impact is confidentiality-only (C:H, I:N, A:N) - no code execution or service disruption. Counterbalancing the network vector, EPSS is very low (0.15%, 5th percentile) and CISA's SSVC decision framework records Exploitation: none, Automatable: no, Technical Impact: partial, so there is no evidence of real-world exploitation and the impact is bounded. The description does not specify what data is disclosed or via which component, so the practical severity of the leaked information cannot be confirmed from available data - the true business risk depends on whether the exposed data includes credentials or only low-value metadata. Net: patch on a normal cycle; not a drop-everything item absent evidence of exposure of high-value secrets. |
| Exploit ScenarioDerived | A remote attacker with network access to the InfoSphere Information Server interface sends a crafted or unauthorized request to an affected endpoint and receives sensitive information in the response without needing credentials or user interaction, consistent with the AV:N/AC:L/PR:N/UI:N vector. No public proof-of-concept has been identified, so exploitation would require the attacker to independently discover the specific vulnerable request. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 02, 2026
Information disclosure in IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 allows remote attackers to obtain sensitive information over the network without authentication (CVSS 3.1 vector AV:N/PR:N, base 7.5). The flaw exposes confidential data (C:H) while leaving integrity and availability untouched, and there is no public exploit identified at time of analysis. EPSS is low (0.15%, 5th percentile) and CISA SSVC rates exploitation as none, indicating this is a real but not urgently exploited issue.
Earlier versions of this analysis (2)
Information disclosure in IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 allows remote attackers to obtain sensitive information over the network without authentication (CVSS:3.1 vector AV:N/PR:N, C:H). The CWE-200 exposure yields high confidentiality impact with no effect on integrity or availability. There is no public exploit identified at time of analysis, and CISA SSVC rates observed exploitation as none; a vendor patch is available.
Information disclosure in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 allows authenticated attackers on an adjacent network to access sensitive data that should be restricted. The CVSS vector (AV:A/PR:L/C:L) confirms two hard prerequisites: the attacker must share network adjacency with the server and hold at minimum low-privileged credentials, substantially limiting the real-world attack surface. No public exploit identified at time of analysis; a vendor patch is available via IBM Security Advisory.
RemediationAI
Patch available per vendor advisory: apply the fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7278188, which covers the affected 11.7.0.0-11.7.1.6 range; the exact patched build number is not stated in the available data, so consult that IBM support page for the specific interim fix or fix pack for your version. As a compensating control until patching, restrict network reachability of the Information Server web/services tier to trusted management networks and place it behind a reverse proxy or WAF that can filter or require authentication on the exposed endpoints, accepting that overly broad filtering could interrupt legitimate DataStage or metadata client traffic. Monitor access logs for anomalous requests to information-returning endpoints, and validate the fix against IBM's advisory rather than relying on version inference. Full advisory and CVE detail: https://nvd.nist.gov/vuln/detail/CVE-2026-9836.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM InfoSphere Information Server is an enterprise data integration platform used for data profiling, cleansing, ETL (via DataStage), and metadata governance across large data warehouses. The single affected CPE is cpe:2.3:a:ibm:infosphere_information_server, spanning the 11.7.x maintenance line. The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a class in which the application returns or leaks data - such as configuration details, internal identifiers, or user/session data - to actors who should not have access, typically through an endpoint or response that fails to enforce proper authorization or output filtering.
Know when Infosphere Information Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable, unauthenticated information disclosure with no user interaction (AV:N/AC:L/PR:N/UI:N); confidentiality-only impact (C:H, I:N, A:N) consistent with CWE-200.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure vulnerability.
Executive ViewAI
IBM InfoSphere Information Server (versions 11.7.0.0-11.7.1.6) exposes organizations to unauthenticated remote access to sensitive confidential data, creating a data breach risk across any instance containing customer information or proprietary assets. Technical severity is rated High (CVSS 7.5), though current threat intelligence indicates low active exploitation likelihood, allowing time for planned remediation. Immediate patching is required to eliminate the information disclosure exposure and protect data confidentiality.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerab
IBM InfoSphere Information Server 11.7 is affected by a remote code execution vulnerability due to insecure deserializat
IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of speci
"IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. Rated critical severity (CVSS 9.8),
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerab
Untrusted search path vulnerability in InfoSphere Import Export Manager 8.1 through 9.1 in InfoSphere Information Server
IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when
XML external entity injection in IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 lets remote attackers who c
"IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing X
IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XM
IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary comma
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to exec
Exploit-DB