What is the CVSS score of EUVD-2026-12643?

EUVD-2026-12643 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-12643?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Planning Analytics Local EUVD-2026-12643

| CVE-2026-1267 MEDIUM

Information Exposure (CWE-200)

2026-03-17 ibm

Authentication Bypass Information Disclosure IBM Planning Analytics Local

6.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates a network-accessible vulnerability with low attack complexity that requires low privileges (authenticated access). The high confidentiality impact (C:H) reflects the ability to exfiltrate sensitive data, while integrity and availability remain unaffected. The requirement for prior authentication (PR:L) reduces the attack surface compared to unauthenticated flaws, though insider threats and credential compromise scenarios remain viable. The CVSS base score of 6.5 places this in the medium severity range, but the practical risk is elevated given that: (1) the vulnerability affects a financial planning application handling confidential business data, (2) a patch is already available from the vendor, indicating the issue is known and potentially under active exploitation, (3) the attack vector is network-based with low complexity, making exploitation straightforward once credentials are obtained or compromised. Organizations should prioritize patching within 30 days, particularly if Planning Analytics Local is internet-facing or accessible to untrusted internal networks. The lack of data integrity or availability impact means this is primarily a confidentiality breach risk rather than a system compromise vector.
Exploit ScenarioDerived	An employee with standard analyst credentials in Planning Analytics Local logs in legitimately to their planning module. Rather than using the GUI, they craft direct API requests to access administrative configuration endpoints or cross-tenant financial data outside their assigned scope. Because the application fails to validate authorization at the endpoint level (relying only on authentication), the requests succeed and sensitive planning data, budget forecasts, or administrative credentials are exfiltrated. Alternatively, an attacker who compromises a standard user account via phishing or credential stuffing can immediately escalate access to read sensitive data that would normally require administrative privileges, bypassing multi-level approval workflows.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 17, 2026

IBM Planning Analytics Local versions 2.1.0 through 2.1.17 contain an improper access control vulnerability (CWE-200) that allows authenticated users to access sensitive application data and administrative functionalities beyond their authorization level. An attacker with valid credentials can leverage this flaw to read confidential planning and analytics data, escalate privileges, or access administrative functions without proper authorization. A vendor patch is available, and this represents a moderate-to-high risk for organizations running affected versions in production environments.

RemediationAI

Upgrade IBM Planning Analytics Local to the patched version provided by IBM (version 2.1.18 or later, as indicated by the affected range 2.1.0-2.1.17). Consult the IBM support advisory at https://www.ibm.com/support/pages/node/7263581 for specific patch filenames and installation procedures applicable to your deployment platform. Until patching is completed, enforce network-level access controls by restricting Planning Analytics Local administrative interfaces and data APIs to trusted IP ranges only, implement IP whitelisting for all user connections, enforce multi-factor authentication for all user accounts to reduce the risk of credential compromise, and conduct an access log audit to identify any unauthorized data access within your environment. Additionally, enable detailed audit logging on the application to track which users accessed which data objects, and review user role assignments to ensure the principle of least privilege is enforced.

Affected VersionsENISA

Planning Analytics Local 2.1.0 ≤2.1.17

Affected Packages

euvd planning_analytics_local no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

IBM Planning Analytics Local is a business intelligence and planning platform that manages sensitive financial and operational data. The vulnerability stems from insufficient access control mechanisms within the application, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The affected product is identified via CPE string cpe:2.3:a:ibm:planning_analytics_local:*:*:*:*:*:*:*:*, which encompasses all versions 2.1.0 through 2.1.17. The root cause involves the application failing to properly enforce role-based access controls (RBAC) or attribute-based access controls (ABAC) when users attempt to access data repositories, administrative consoles, or system configuration endpoints. This allows privilege escalation even without exploiting authentication mechanisms—the user is authenticated but can bypass authorization checks through direct API calls, parameter manipulation, or by exploiting missing endpoint-level permission validation.

Know when Planning Analytics Local gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 17, 2026 - 22:08 nvd

Patch available

CVE Published

Mar 17, 2026 - 21:50 nvd

MEDIUM 6.5

DescriptionCVE.org

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an unauthorized access to sensitive application data and administrative functionalities due to lack of proper access controls.

Executive ViewAI

Why It Matters

CVE-2026-1267 presents notable security risk, a information exposure vulnerability rated CVSS 6.5. Sensitive information could be exposed to unauthorized parties. A patch is available and should be applied during regular vulnerability management.

Business Impact: Moderate

Compensating Controls

Apply vendor patch. If patching is delayed: restrict endpoint access, redact sensitive data in logs.

Threat Intelligence Overview

EPSS Score

0.0%

Top 91% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +32

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.