Tivoli Netcool Impact EUVD-2026-20028

Local user access required on IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37. Attacker must read log files containing sensitive information. No authentication or victim interaction required.

The CVSS 8.4 score reflects High severity driven by the triple-High impact ratings (C:H/I:H/A:H), indicating that compromised secrets could enable full system control. However, real-world risk is constrained by the Local attack vector requiring existing system access, which significantly reduces the exploitable population compared to network-accessible vulnerabilities. The PR:N (no privileges required) and AC:L (low complexity) parameters indicate that any local user, including low-privilege accounts, can trivially read the logs without specialized techniques. This creates insider threat risk and amplifies impact in multi-tenant or shared hosting environments. With no CISA KEV listing, no identified public exploit code, and EPSS probability data unavailable, there is no evidence of active exploitation campaigns. From an SSVC perspective, the vulnerability appears automatable once local access exists, but the prerequisite local access requirement limits widespread automated exploitation. Priority should be elevated for environments with untrusted local users, jump hosts, compromised accounts from prior incidents, or where Netcool Impact runs on shared infrastructure. Organizations with strict physical and logical access controls face lower immediate risk but should still prioritize patching to maintain defense-in-depth.

An attacker who has gained initial local access to a server running IBM Tivoli Netcool Impact through compromised SSH credentials, a separate web application vulnerability, or insider access navigates to the application log directory. Due to the AC:L and PR:N characteristics, the attacker simply reads log files using standard filesystem operations without requiring elevated privileges. The logs contain cleartext database connection strings, LDAP bind credentials, or API authentication tokens. The attacker extracts these secrets and uses them to authenticate to backend systems with the privileges of the Netcool Impact service account, achieving lateral movement to monitoring databases, connected network devices, or integrated IT service management platforms, escalating from limited local access to enterprise-wide compromise.