What is the CVSS score of EUVD-2026-58360?

EUVD-2026-58360 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of IBM Planning Analytics are affected by EUVD-2026-58360?

IBM Planning Analytics 2.0 and 2.1 Local contains a vulnerability allowing attackers to trick logged-in users into unknowingly executing unauthorized actions on the platform.. A patch is available.

How to fix or mitigate EUVD-2026-58360?

Within 24 hours, inventory all IBM Planning Analytics 2.0 and 2.1 Local installations in your environment and issue a security alert to users warning against clicking suspicious links or visiting untrusted websites while logged into Planning Analytics. Within 7 days, apply the vendor-released patch available via IBM advisory https://www.ibm.com/support/pages/node/7283486 to all affected Planning Analytics instances. Within 30 days, verify patch deployment across all systems, document remediation completion, and conduct targeted user security awareness training on phishing prevention.

IBM Planning Analytics EUVD-2026-58360

| CVE-2026-13365 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-08-13 ibm

GHSA-7r55-v7vr-m7mw

CSRF IBM Planning Analytics

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

7.1 HIGH

CSRF inherently requires victim interaction (UI:R) and no attacker privileges (PR:N); high integrity impact reflects ability to forge arbitrary user actions; no data disclosure makes C:N accurate.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Severity Changed

Aug 17, 2026 - 17:52 NVD

HIGH MEDIUM

CVSS changed

Aug 17, 2026 - 17:52 NVD

7.1 (HIGH) 6.5 (MEDIUM)

Analysis Generated

Aug 13, 2026 - 20:39 vuln.today

CVE Published

Aug 13, 2026 - 19:34 nvd

HIGH 7.1

DescriptionNVD

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

AnalysisAI

Cross-site request forgery in IBM Planning Analytics 2.0 and 2.1 Local enables network-based attackers to force authenticated users into executing unauthorized actions against the platform without their knowledge. The CVSS vector (PR:N/UI:R) confirms the attacker requires no credentials but must socially engineer an authenticated victim into visiting a malicious page or clicking a crafted link. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory https://www.ibm.com/support/pages/node/7283486.

Technical ContextAI

IBM Planning Analytics (formerly Cognos TM1) is an enterprise AI-driven financial planning and analytics platform. CWE-352 (Cross-Site Request Forgery) arises when the application fails to validate that state-changing requests originate from its own trusted interface rather than from attacker-controlled third-party pages. Browsers automatically attach session cookies to cross-origin requests, so an authenticated victim's browser unwittingly forwards valid credentials when it loads a crafted payload on an attacker's page. The CPE cpe:2.3:a:ibm:planning_analytics:*:*:*:*:*:*:*:* with a wildcard version field indicates the vulnerability spans multiple sub-versions within the 2.0 and 2.1 Local release lines. The 'Local' designation indicates on-premises deployments rather than IBM's SaaS offering.

RemediationAI

IBM has released a patch addressing this vulnerability; the exact patched version and upgrade procedure should be obtained directly from the vendor advisory at https://www.ibm.com/support/pages/node/7283486. Until patching is complete, compensating controls include configuring the Planning Analytics web server to emit a strict Referrer-Policy header (e.g., same-origin) to block cross-origin request forgery attempts, and enforcing SameSite=Strict or SameSite=Lax on session cookies to prevent browsers from forwarding credentials on cross-origin navigations - note that SameSite=Strict may break cross-domain SSO flows if in use. Restricting access to the Planning Analytics web interface via network-layer controls (firewall rules, VPN requirement) to trusted IP ranges reduces the population of attackers who can reach the application to deliver CSRF payloads. User awareness about avoiding unsolicited links while authenticated is a supplementary but not sufficient control.