IBM Planning Analytics EUVD-2026-98079

Exploitation requires the attacker to already possess valid low-privilege authenticated access to IBM Planning Analytics 2.0 or 2.1 (CVSS PR:L), after which an improper-authentication weakness (CWE-288) permits escalation to unauthorized administrative access. The limiting factor is this prerequisite of existing authenticated access - the flaw is not exploitable by a fully unauthenticated outsider per the PR:L vector; no special non-default configuration or user interaction (UI:N) is indicated as required by the available data. Affected deployments are limited to Planning Analytics versions 2.0 and 2.1; a vendor patch is available to remediate.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a low-privilege, network-reachable authentication flaw (CWE-288) that lets an already-authenticated low-privilege user escalate to full administrative access with high confidentiality, integrity, and availability impact. The attack vector is network with low complexity and no user interaction, which raises concern, but PR:L means an attacker must first hold valid low-privilege credentials, narrowing the exploitable population to users who already have some access (insiders, compromised accounts, or environments where self-registration/weak accounts exist). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no current signal of active or imminent widespread exploitation - this appears to be a high-CVSS issue that is a real patch priority but not yet a confirmed in-the-wild threat. No SSVC decision data was supplied. A vendor patch is available, which should drive remediation prioritization even in the absence of exploitation telemetry. No conflicts between the vector and description were detected: both point to remote, authentication-related privilege escalation.

An attacker holding a valid low-privilege IBM Planning Analytics account (or who has compromised such an account) sends crafted requests that bypass the application's authentication/authorization logic, obtaining administrative access to the planning environment. From there they can read and alter sensitive financial planning data, change configurations, or disrupt availability. No public exploit code was identified at time of analysis.