IBM EUVD-2026-15976

The CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates a moderate-to-high severity issue with important mitigating factors. The attack vector is network-based with low attack complexity, but critically requires low privilege level (authenticated user). The high confidentiality impact combined with no integrity or availability impact classifies this as an information disclosure threat. While the CVSS score is elevated, the requirement for valid credentials significantly reduces real-world exploitation surface compared to unauthenticated vulnerabilities. The absence of public POC code and no indication of KEV status suggests this is not yet a widespread exploitation target, though the availability of vendor patches indicates IBM took the threat seriously. From an SSVC perspective, this represents a situation where exploitation is possible but requires legitimate system access, technical impact is limited to data confidentiality, and patching is readily available, making this a medium priority for organizations running affected versions but not an emergency.

An insider threat or compromised account with basic authentication credentials could manipulate crafted requests to the InfoSphere Information Server JSON API to extract sensitive information such as database connection strings, encryption keys, or metadata about protected data assets. Since the attack requires only network access and valid credentials (commonly held by data stewards, analysts, or contractors), exploitation could occur without triggering typical security alerts. For example, a disgruntled employee with read-only analytics access could modify JSON request parameters to access sensitive data governance metadata or connection details for restricted databases, exfiltrating the information for competitive advantage or sale to threat actors.