EUVD-2026-104675
GHSA-h98j-v79p-phw9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege TRIRIGA account
-
DeliverySend crafted request to platform
-
ExploitExploit improper authentication flaw
-
ExecutionExecute arbitrary code on server
-
ImpactFull compromise of application and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Affects IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8. Per the CVSS vector (PR:L), exploitation requires authenticated access as a low-privilege user to the network-reachable platform; no user interaction and no special non-default configuration is called out in the description. The improper-authentication weakness (CWE-287) is the core enabler, and the description/tags suggest some authentication control can be improperly satisfied - defenders should confirm with IBM whether valid credentials are strictly required or whether the auth check can be bypassed. The main limiting factor is the need for authenticated (low-privilege) access and network reachability to the TRIRIGA Application Platform; versions outside 5.0.0-5.0.8 are not indicated as affected. |
| Impact | This is a genuinely high-priority flaw by raw severity: the NVD CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable, low-complexity arbitrary code execution requiring only low-privilege authentication and no user interaction, with full compromise of confidentiality, integrity, and availability. However, several real-world signals that would elevate it to emergency status are absent: no EPSS probability was supplied, the CVE is not listed in CISA KEV, and no public exploit code was identified, so exploitation status is 'no public exploit identified at time of analysis.' There is also an internal tension worth flagging: the description and tags characterize this as 'improper authentication'/'Authentication Bypass' (CWE-287), which can imply pre-auth abuse, yet the CVSS vector asserts PR:L (a valid low-privilege account is needed) - these partially conflict, so verify the true authentication prerequisite with IBM before treating it as either fully pre-auth or fully authenticated. Net assessment: a serious, patch-worthy RCE in an enterprise platform, but without EPSS/KEV/POC evidence it is a prioritize-and-patch item rather than confirmed active-exploitation fire-drill. |
| Exploit ScenarioDerived | An attacker with a low-privilege TRIRIGA account (or one who abuses the improper-authentication weakness to obtain authenticated context) sends crafted requests over the network to the TRIRIGA Application Platform. Because attack complexity is low and no user interaction is required, the flaw is leveraged to execute arbitrary code on the server, yielding full control of the application and its data. No public proof-of-concept was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Remote code execution in IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 stems from an improper-authentication weakness (CWE-287) that lets a network-reachable, low-privilege authenticated attacker execute arbitrary code with no user interaction. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates full loss of confidentiality, integrity, and availability once the flaw is triggered. No public exploit code was identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV); the primary constraint on attackers is the need for low-privilege authenticated access to the TRIRIGA platform.
RemediationAI
No exact fixed version is identified in the provided data, so the primary action is to consult IBM's advisory at https://www.ibm.com/support/pages/node/7292418 and apply the vendor-released fix for the affected 5.0.0-5.0.8 deployments; do not assume 5.0.8 or any specific build is remediated without IBM confirmation. Until a fix is applied, reduce exposure by restricting network access to the TRIRIGA Application Platform through VPN, reverse-proxy allowlisting, or network segmentation so only required users can reach it, accepting the trade-off of reduced remote accessibility. Enforce least privilege and review low-privilege accounts, since the assessed vector requires PR:L access, and enable strong authentication or MFA where supported to raise the cost of credential abuse. Monitor authentication and application logs for anomalous logins or post-authentication code-execution indicators, and disable unnecessary remote or administrative interfaces; these are compensating controls only and do not correct the underlying improper-authentication flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM TRIRIGA Application Platform is an enterprise integrated workplace management system used for real estate, facilities, and capital-project workflows, typically exposed as a web application. The root cause is classified as CWE-287 (Improper Authentication): an authentication control can be improperly satisfied, and the description links that weakness to arbitrary code execution. Per the CVSS vector PR:L, exploitation requires authenticated access as a low-privilege user, with network reachability and low attack complexity, and no user interaction. The advisory and tags leave some ambiguity about whether valid credentials are strictly required or whether the authentication check itself can be bypassed, so defenders should confirm that detail with IBM while treating the issue as an authenticated-to-RCE path. Versions outside 5.0.0 through 5.0.8 are not indicated as affected in the available data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable RCE with low complexity and no user interaction; PR:L retained because the vector states a low-privilege account is required, yielding full C/I/A impact.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.
Executive ViewAI
IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 contain a high-severity remote code execution flaw that a low-privilege authenticated network attacker could use to fully compromise confidentiality, integrity, and availability. Because no vendor patch is available and exploitation requires an existing low-privilege account, leadership should prioritize reducing exposed access and monitoring for misuse while IBM remediation is pursued.
No vendor-released patch identified at time of analysis; restrict network access to IBM TRIRIGA Application Platform 5.0.0 through 5.0.8, enforce least privilege and MFA where supported, review and disable unnecessary low-privilege accounts, monitor authentication and code-execution logs, and deploy WAF/IPS virtual patching if available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB