EUVD-2026-106870
GHSA-fcwc-2m35-hm2c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege credentials
-
DeliverySend oversized crafted input to service
-
ExploitOverflow stack buffer (missing bounds check)
-
ExecutionExecute arbitrary code on host
-
ImpactFull compromise of Planning Analytics server
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid low-privilege authentication to IBM Planning Analytics (PR:L), delivered over the network (AV:N) with no user interaction (UI:N) and low complexity (AC:L); the attacker must be able to reach the affected network service on a running Planning Analytics 2.0 or 2.1 instance and supply input that reaches the vulnerable, improperly bounds-checked stack buffer. The principal limiting factor is the credential requirement - a fully unauthenticated external attacker cannot trigger it per the CVSS vector - so exposure is driven by how broadly authenticated access (including low-privilege user accounts) is granted and whether the server is reachable from untrusted networks. The specific affected feature/endpoint is not named in the provided data; consult IBM advisory node/7291604 to scope the exposed component. |
| Impact | This is a genuine high-priority vulnerability by signal quality, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw that nonetheless requires some level of authentication (PR:L), yielding full compromise (C:H/I:H/A:H) - consistent with a stack-based buffer overflow (CWE-121) leading to arbitrary code execution. Scope is Unchanged (S:U), so impact is confined to the Planning Analytics host. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The vulnerability is NOT listed in CISA KEV and no public POC is referenced, so this is no public exploit identified at time of analysis. The combination of memory-corruption RCE plus the PR:L requirement means the realistic threat is from an authenticated user or an attacker who has already obtained valid (even low-privilege) TM1/Planning Analytics credentials, rather than a fully anonymous internet-wide mass-exploitation scenario. The single IBM support advisory (node/7291604) is the primary authoritative source; the EUVD reference merely points back to the NVD record. Net: treat as a serious patch-soon item for internet- or intranet-exposed Planning Analytics servers, but the authentication prerequisite and absence of known exploitation lower it below drop-everything urgency. |
| Exploit ScenarioDerived | An attacker holding low-privilege Planning Analytics credentials (or who has phished/obtained them) sends a crafted oversized input to the affected network-facing service, overflowing a stack buffer due to missing bounds checking and executing arbitrary code on the server. Because no user interaction is needed and attack complexity is low, a single malformed request from an authenticated session can achieve code execution. No public exploit code is referenced, so an attacker would need to develop the overflow primitive themselves. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Stack-based buffer overflow (CWE-121) in IBM Planning Analytics 2.0 and 2.1 allows a remote attacker who holds valid low-privilege credentials to overflow an improperly bounds-checked stack buffer and potentially execute arbitrary code on the Planning Analytics server. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) confirms network reachability, low attack complexity, no user interaction, and high confidentiality, integrity and availability impact, with the credential requirement being the principal limiting factor rather than any technical obstacle. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is a high-priority patching item rather than an emergency, with exposure driven by how widely authenticated access is granted and whether the service is reachable from untrusted networks.
RemediationAI
IBM has published an advisory at https://www.ibm.com/support/pages/node/7291604; consult it for the exact patched release or interim fix applicable to your Planning Analytics 2.0 or 2.1 build - no specific fix version is available in the provided data, so treat this as "no vendor-released patch identified at time of analysis" and verify the current fix level directly with IBM before assuming a build is clean. Where upgrading immediately is not possible, apply compensating controls that directly address the PR:L prerequisite and the network exposure: restrict network access to the Planning Analytics service to trusted subnets or VPN segments via firewall/security-group rules (effective, but breaks legitimate remote and partner access), enforce least privilege and aggressively prune low-privilege accounts and default credentials so the authenticated attack surface is minimized (reduces but does not eliminate risk, since any valid account satisfies the vector), and front the service with a reverse proxy or WAF applying request-size and input-format limits to blunt oversized payloads reaching the vulnerable buffer (partial mitigation only, easily bypassed by encoding). Add logging and alerting for anomalous authentication patterns and oversized or malformed requests to the Planning Analytics endpoints while remediation is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic stack-based buffer overflow (CWE-121), which arises when a routine copies attacker-influenced data into a fixed-length stack buffer without validating that the input length fits, overwriting adjacent stack memory including saved registers and return addresses. Because the overflow occurs on the stack rather than the heap, successful corruption can redirect control flow and, in the worst case, lead to arbitrary code execution in the context of the Planning Analytics service account. The affected component sits behind a network-facing service in the IBM Planning Analytics 2.0 and 2.1 releases (confirmed by the EUVD affected-version list and the corresponding CPE-level scoping in the IBM advisory); the vulnerable code path is reached only after authentication, since the assessed vector carries PR:L. The precise endpoint or feature containing the unchecked copy is not disclosed in the available intelligence and should be confirmed against IBM support node 7291604, which is the authoritative source for affected components and build levels.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable service (AV:N) with low-complexity overflow (AC:L) but requiring authenticated low-privilege access (PR:L); arbitrary code execution yields full C/I/A impact on the unchanged host scope.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.
Executive ViewAI
IBM Planning Analytics 2.0 and 2.1 contain a high-severity stack buffer overflow that allows an authenticated low-privilege user to potentially execute arbitrary code on the Planning Analytics server, with high impact to confidentiality, integrity, and availability. Because exploitation requires only valid credentials rather than sophisticated technical access, the practical exposure depends on how broadly Planning Analytics accounts are provisioned and whether the service is reachable from untrusted networks. Leadership should treat this as a high-priority patching item for any internet-facing or widely used deployment; no public exploit was identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to trusted networks, enforcing least privilege and strong authentication, segmenting Planning Analytics servers, and monitoring authenticated activity for anomalies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB