EUVD-2026-71601
GHSA-pqx8-h6gr-6xwr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed ODM web endpoint
-
DeliveryInject SQL via vulnerable parameter
-
ExploitUse DB file-write to drop web shell in web root
-
ExecutionRequest web-shell URL
-
PersistExecute OS commands as app server
-
ImpactFull remote code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to an affected IBM ODM web-facing component (Decision Center / Decision Server / Rule Execution Server) running one of the listed versions (8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, 9.6.0.0); no authentication, credentials, or user interaction are needed (PR:N/UI:N). The full RCE outcome additionally depends on the backing database account having file-write / OUTFILE-style privileges to the application web root - if the DB account is hardened against file writes, the attacker is limited to SQL data access/manipulation rather than web-shell code execution. Limiting factors are therefore: exposure of the ODM console to the attacker's network, an unpatched affected version, and a database privilege configuration permitting file writes. |
| Impact | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-impact case: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a remotely reachable, low-complexity, unauthenticated flaw, and the described chain from SQLi to web-shell RCE means an attacker gains code execution rather than mere data disclosure. No EPSS score, KEV listing, or public PoC was provided in the input, so exploitation is not yet confirmed active - but unauthenticated pre-auth SQLi in enterprise middleware is exactly the class of bug that gets weaponized quickly, so absence of a PoC should not lower urgency. Any organization running an affected ODM version, whether a large enterprise or a mid-sized operator, should treat internet- or intranet-exposed instances as urgent and patch immediately. The main missing signals are EPSS probability and KEV status; the CVSS-to-description alignment is internally consistent (network vector matches the 'unauthenticated attacker' language), so confidence in the severity is high. |
| Exploit ScenarioDerived | An unauthenticated attacker locates an exposed ODM web endpoint, submits a crafted request that injects SQL into a vulnerable parameter, and uses the database's file-write capability to plant a JSP/servlet web shell in the application web root. The attacker then requests that web-shell URL to run operating-system commands in the application server's context, achieving persistent remote code execution. No credentials or user interaction are required, consistent with the AC:L/PR:N/UI:N vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
SQL injection in IBM Operational Decision Manager (versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0) lets a remote unauthenticated attacker inject arbitrary SQL statements and abuse database write functionality to drop a web shell into the application web root, escalating a data-access flaw into full remote code execution. The CVSS 9.8 rating reflects unauthenticated network reach with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, but the attack primitive (SQLi-to-webshell) is well understood and reliably weaponizable.
RemediationAI
Apply the fix from the IBM security advisory at https://www.ibm.com/support/pages/node/7286196 - consult that bulletin for the exact interim fix / iFix or upgraded version corresponding to your deployed release, as no single fixed version string is provided in the input data (patch available per vendor advisory; exact fix version not restated here to avoid inventing a number). Until patched, restrict network access to the ODM web consoles and Rule Execution Server endpoints to trusted management networks only (side effect: legitimate remote administration must move behind VPN/bastion), deploy a WAF rule set to detect and block SQL-injection payloads against ODM URLs (side effect: possible false positives on complex rule payloads), and constrain the ODM database service account so it cannot write files to disk or the web root (revoke FILE/OUTFILE and equivalent privileges), which directly breaks the SQLi-to-webshell escalation while leaving read paths still risky. Monitor the web root for newly created script files as a detection control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IBM Operational Decision Manager (ODM) is a business rules management system (BRMS) used to author, execute, and manage decision logic in enterprise Java/WebSphere environments, exposing web-based consoles (Decision Center / Decision Server / Rule Execution Server). The root cause is CWE-89 (improper neutralization of special elements used in an SQL command): user-controllable input reaches a SQL query without adequate parameterization/escaping, allowing statement injection. The severity is amplified because the backing database account has sufficient privileges (e.g., INTO OUTFILE / stored-procedure or file-write capabilities) to write a file to the servlet container's web root, converting database access into arbitrary code execution within the application server context.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) that escalates to web-shell RCE gives full C:H/I:H/A:H; scope kept U as impact stays within the app/DB security authority.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
Executive ViewAI
IBM Operational Decision Manager instances across multiple versions contain a critical SQL injection vulnerability allowing unauthenticated remote attackers to achieve complete system compromise. No public exploit has been identified at time of analysis, though given the severity and lack of available patches, immediate mitigation is essential. Affected organizations face exposure to data theft, manipulation of business logic, and operational disruption. This represents an urgent risk to any enterprise relying on ODM for critical decisions.
No vendor-released patch identified at time of analysis. Implement network segmentation to restrict access to affected ODM instances; deploy Web Application Firewall (WAF) rules to block SQL injection patterns; implement database activity monitoring (DAM) to detect unauthorized SQL statements; enforce parameterized queries and comprehensive input validation at application boundaries; establish monitoring for exploitation attempts in application and database logs; evaluate temporary migration of critical business processes to alternative decision platforms until patches become available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB