IBM
Monthly
Command injection in the IBM Guardium Data Protection 12.2 CLI certificate S/MIME recipient deletion routine allows an authenticated user holding a privileged CLI role to execute arbitrary shell commands with root privileges on the appliance. The flaw sits in a specific certificate/S/MIME management code path and requires high-privilege authentication plus interactive access to the command-line interface, so it is best characterized as an access-gated privilege escalation and post-compromise escalation primitive rather than a mass-exploitation threat. Patch status is "Patch available per vendor advisory" (IBM support page node/7288034); no public exploit identified at time of analysis, and no EPSS score was supplied with the intelligence feed.
Command injection in IBM Guardium Data Protection 12.2 allows an authenticated, highly privileged CLI user to execute arbitrary operating-system commands as root, escaping the restricted certificate-export shell (scope change) and fully compromising confidentiality, integrity, and availability. The flaw is CWE-78 (OS command injection) in the certificate export CLI path and carries a vendor CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation is gated behind privileged CLI authentication, and no public exploit code or confirmed active exploitation has been identified at time of analysis; IBM has released a vendor patch.
Command injection in IBM Guardium Data Protection 12.2 lets an authenticated attacker who can influence security policy alert text execute arbitrary operating system commands with root privileges through the SNMP alert notification functionality. Exploitation is gated behind valid credentials with policy-authoring capability and requires that the deployment actually uses SNMP alerting, so this is a privileged-insider or compromised-account risk rather than an opportunistic remote attack; no public exploit code was identified at time of analysis and CISA SSVC records no known exploitation. IBM has published a vendor patch, and the EPSS score is low (0.67%, ~50th percentile), consistent with a credible high-impact issue that is not an emergency.
Path traversal in IBM Guardium Data Protection 12.2's Datasource REST component allows authenticated remote attackers with low privileges to delete arbitrary files, causing denial of service and integrity impact. The flaw requires network access to the REST API and valid credentials (CVSS PR:L), with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available.
Unauthenticated attackers on the management network can crash the ASMI web interface on IBM Server Firmware by sending a malformed HTTPS request, causing a temporary denial of service that may become sustained with repeated exploitation. The vulnerability is an out-of-bounds read (CWE-125) with a CVSS score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H); while the interface restarts automatically after a single crash, sustained attacks could lead to a persistent loss of management access. No public exploit identified at time of analysis; this is a moderate-risk availability flaw, not a critical priority, and exposure is limited to attackers already on the management network segment.
Arbitrary code execution in IBM Guardium Data Protection 12.2 is reachable by an authenticated, high-privilege user who can write to or otherwise influence the Quartz JDBC job store, because the scheduler deserializes stored job data without validating the Java object graph it reconstructs. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) requires valid privileged credentials but no victim interaction, and successful exploitation gives full loss of confidentiality, integrity, and availability on the affected server. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but IBM has published a vendor patch to remediate the issue.
IBM Guardium Data Protection 12.2 stores internal REST service-account credentials in a reversible, plaintext-equivalent format (CWE-256), so an authenticated attacker who can read that stored value can recover the underlying password and mint an administrative REST access token. The flaw is network-reachable but requires a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the ability to reach the credential storage location, which makes it condition-dependent rather than mass-exploitable - SSVC rates exploitation as none and automatable as no, EPSS sits at 0.24% (13th percentile), and no public exploit code or CISA KEV entry is associated with the issue. A vendor patch is available, so the practical risk is concentrated in unpatched 12.2 deployments where low-privileged or delegated accounts exist.
Authenticated path traversal in IBM Guardium Data Protection 12.2 allows a remote low-privilege user with a valid management-interface session to read sensitive information, delete arbitrary files, or execute arbitrary code. The flaw is a CWE-22 directory-restriction bypass; SSVC rates exploitation as non-automatable, suggesting targeted rather than mass-scanning abuse, and no public exploit was identified at time of analysis (EPSS 0.54%). Patch available per vendor advisory.
Authenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Installation Manager) bundle import functionality to supply a crafted bundle whose contents cause attacker-controlled arguments to be passed to the underlying tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager. The flaw is network-reachable and requires only low-privileged authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) with no victim user interaction, so any account able to trigger a bundle import should be considered capable of full compromise of the Central Manager. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a fix advisory.
Authenticated path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote user holding valid low-privileged credentials to reach files outside the directory the application intends to restrict, producing a high integrity impact (I:H) and a limited availability impact (A:L) while the published vector shows no direct confidentiality loss. Exploitation is remote (AV:N) but rated high complexity (AC:H), meaning success depends on target-specific conditions such as exact file paths or platform state, and it requires a valid account (PR:L) with no user interaction (UI:N). No public exploit code or CISA KEV entry was identified at time of analysis, so this is a real but moderate-priority flaw for unpatched 5.4.0.0 deployments; IBM has published a fix through its support advisory.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a low-privileged user with network access to the service reach an unsafe deserialization sink and execute arbitrary code in the context of the affected component. The issue is CWE-502 (deserialization of untrusted data) rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so a successful attack yields high confidentiality, integrity and availability impact with no user interaction required. Exploitation requires previously obtained valid CP4D/DataStage credentials (PR:L) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none and the attack as not automatable, though the technical impact is rated total.
Authenticated command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker with valid low-privileged credentials to execute arbitrary operating-system commands, potentially compromising confidentiality, integrity, and availability (CVSS 8.8). Exploitation requires network reachability to the DataStage/CP4D interface and the ability to supply input that is mapped into an unneutralized environment variable (CWE-78); no user interaction is needed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with total technical impact, so this is a genuine high-severity finding but not an emergency.
Server-side request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker to make the server issue requests to internal endpoints and return sensitive information by supplying a manipulated X-Forwarded-Proto header that the application fails to validate. Exploitation requires a valid account on the platform (CVSS PR:L) with network access to the DataStage web interface; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The vendor/NVD CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reads as Critical, but the independent assessment scores it C:H/I:N - a confidentiality-only SSRF whose real-world impact depends on which internal services the DataStage host can reach and what those endpoints expose.
Command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only a low-privilege account to execute arbitrary OS commands on the host, with high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid credentials and the ability to reach a code path that constructs an operating system command from user-supplied input without neutralizing shell special elements; no user interaction is needed, and the deployment context - an internal enterprise ETL service rather than an internet-facing endpoint - plus the narrow affected version materially constrain real-world exposure. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); a vendor patch is available per IBM's advisory.
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitrary operating system commands by exploiting a path traversal flaw (CWE-22). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a High severity score of 8.8, reflecting full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and a vendor patch is available.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements that are passed into an OS command, allowing a remote attacker holding any low-privilege platform account to execute arbitrary operating-system commands on the DataStage host with the privileges of the vulnerable service. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exposure is gated by authentication: there is no anonymous internet-facing path, but multi-tenant deployments, shared service accounts, or any compromised low-privileged credential are sufficient to reach full command execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, while a vendor patch is available.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) run arbitrary operating system commands on the affected platform, yielding high confidentiality, integrity, and availability impact for an overall CVSS base score of 8.8. Exploitation requires a valid CP4D session and access to the DataStage functionality that forwards attacker-controlled input into a shell command without sanitization; no public exploit identified at time of analysis, and IBM has published a vendor fix. Only the 5.4.0.0 build is explicitly named as affected, so patched builds referenced in IBM's advisory remove the exposure.
SQL injection in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 allows remote unauthenticated attackers to view, add, modify, or delete back-end database information. The flaw (CWE-89) carries a CVSS 3.1 base score of 8.6, with an independent assessment vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating high confidentiality and integrity impact and low availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch is available via IBM support.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only a low-privilege account to execute arbitrary operating-system commands on the underlying host, fully compromising the confidentiality, integrity and availability of the affected deployment. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) confirms network reachability, low attack complexity, mandatory authentication at the low privilege level and no user interaction, matching the independent assessment that this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk artifact. No public exploit code was identified at time of analysis, and a vendor patch is available through IBM support node 7288649; accordingly, real-world risk is concentrated in reachable, unpatched 5.4.0.0 deployments rather than in broad opportunistic exploitation.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read files and reach resources outside the application's security scope by submitting crafted XML to an XML-processing function (CWE-611 XML external entity injection). The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N rates this 7.7 High: confidentiality impact is high with a scope change, but there is no integrity or availability effect, meaning the outcome is data exposure rather than code execution or service disruption. Exploitation requires a valid low-privilege DataStage account and network reachability to the affected XML handling surface; no user interaction is needed, and no public exploit identified at time of analysis. Patch available per vendor advisory (IBM support page node/7288649).
Credential disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated user recover encrypted credentials that were issued for other users or environments, because the product mishandles encrypted credential material. Exploitation is network-reachable and requires no user interaction, but it does require a valid low-privileged account on the deployment (CVSS 3.1: 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so the risk is a bounded confidentiality exposure that grows with the number of users and environments sharing the cluster rather than a remotely exploitable anonymous flaw; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV). A vendor patch is available per IBM's advisory.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker with only low-privilege credentials run arbitrary commands on the underlying host, yielding full confidentiality, integrity, and availability impact. The flaw requires network reachability to the DataStage service but no user interaction and no non-default configuration, so any valid low-privilege account is sufficient to attempt exploitation; the platform is a specialized enterprise deployment typically placed behind organizational access controls rather than exposed to the internet. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), but a vendor patch is available per IBM's advisory, and the low attack complexity and high impact make prompt patching advisable.
Remote authenticated code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible because connector property values are not properly escaped when OSH scripts are generated, allowing an attacker with a valid account and the ability to define or edit connector properties to inject commands that execute with DataStage privileges. The flaw is network-reachable, low-complexity, and requires no victim interaction, but it requires authentication (CVSS 3.1 PR:L) and is rated 8.8 HIGH (C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified in the provided intelligence, and a vendor patch is available via IBM support.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker holding low-privilege credentials to execute arbitrary commands on the underlying system, with high impact to confidentiality, integrity, and availability. The flaw stems from improper neutralization of special elements used in OS commands (CWE-78), and exploitation requires a valid authenticated session plus reachability of the specific DataStage feature that passes user-supplied input into a shell command; no user interaction is needed. No public exploit code has been identified and there is no evidence of active exploitation (not listed in CISA KEV), but a vendor patch is available and the issue should be treated as a genuine high-priority fix rather than a high-CVSS-but-low-risk artifact.
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged account on the host execute arbitrary code by manipulating the search path used when Concert spawns operating system commands. Because Concert does not fully qualify the executable paths it invokes, a malicious binary placed earlier in the search order is executed with the privileges of the Concert process. The flaw is scored CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires local system access plus the ability to influence path resolution; no public exploit code has been identified at time of analysis and this CVE is not in CISA KEV. A vendor patch is available.
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow corrupt heap memory, crash the application, or potentially hijack control flow for code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a vendor fix (advisory node 7288830). The vendor-published vector claims unauthenticated network exploitation at 9.8, but our assessment scores the issue AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: the practical attack is high-complexity, requires an authenticated position to supply the malicious input, and the specific trigger surface is unconfirmed, so real-world severity is materially lower than the published base score suggests.
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access to the host trigger a double free (CWE-415) and, with heap grooming, execute arbitrary code in the context of the affected process. Exploitation is authenticated and local only - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8) - with full confidentiality, integrity, and availability impact when successful; no public exploit identified at time of analysis. IBM has published a vendor advisory and patch guidance at https://www.ibm.com/support/pages/node/7288830.
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that overflows a buffer and achieves arbitrary code execution under the privileges of the affected process, matching the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. IBM's own advisory scores the issue 9.8 with a network/unauthenticated vector (AV:N/AC:L/PR:N/UI:N), but the vendor description explicitly states a 'local user' is required, so realistic exposure is confined to systems where an attacker already has a local account - a foothold-to-full-compromise escalation rather than a pre-authentication remote RCE. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM has published an advisory with a vendor-supplied fix.
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service send specially crafted input that is incorporated into operating-system commands, executing arbitrary commands with the privileges of the Concert application. The vulnerability is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction, and no special conditions are required - only network reachability of an unpatched instance. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation appears opportunistic-dependent rather than confirmed in the wild, but IBM has published a vendor fix, so the priority is to patch exposed instances before exploit code or scanning activity emerges.
Unauthenticated remote attackers can manipulate SQL database queries in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, giving them a high-integrity impact with limited confidentiality and availability effects on affected payments-processing deployments. The flaw is a boolean-based blind SQL injection rooted in improper neutralization of special elements in a boolean expression (CWE-74), exploitable over the network with low complexity and no authentication or user interaction per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (base 8.2). No public exploit code has been identified and there is no confirmation of active exploitation; IBM has published a vendor advisory containing patch guidance, but affected version ranges are expressed as a wildcard CPE, so defenders must match their specific build against IBM's advisory to determine exposure.
Unauthenticated insertion of malicious runbook content into the vector database backing IBM Financial Transaction Manager (FTM) for Red Hat OpenShift's AI agent allows retrieval-augmented generation (RAG) poisoning that can steer AI-driven MCP tool calls toward unauthorized payment actions or exfiltration of payment data. IBM self-rates the issue CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting unauthenticated network reachability and low attack complexity rather than high per-impact severity, since the realized effect is mediated by LLM behavior and is probabilistic rather than deterministic. The flaw is rooted in CWE-74 at api.vectordb.runbooks.js:51; no public exploit code identified at time of analysis and the issue is not tied to confirmed active exploitation, with exposure limited to deployments where the FTM AI agent endpoint is network-accessible and the agent has MCP tools wired to payment-affecting actions.
Stored cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker with adjacent-network positioning to plant script inside stored network acknowledgement data, which then executes in the browsers of authenticated FTM operators and can lead to session hijacking and unauthorised operator-level payment actions. The flaw sits in the NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42), which renders stored acknowledgement content without adequate output encoding. The vendor rates it 9.3, while the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, where the requirement that a legitimate operator open the affected view is the practical limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the payments context and scope change keep the impact ceiling high.
Unauthenticated remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment to send a crafted Java-serialized payload to the PayDir Business Rules Manager RMI SSL endpoint and execute arbitrary code on the target host. Because the vulnerable service is exposed with no authentication and no user interaction required (CVSS 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation exposes all PayDir credentials and enables manipulation of payment business rules, producing high confidentiality and integrity impact. The adjacency requirement is the primary limiting factor, and no public exploit identified at time of analysis; a vendor patch is available per the IBM advisory.
Missing authentication for a critical function in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to read sensitive information and modify system configurations on an affected deployment. With CVSS 7.3 (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are required, so any network-reachable FTM instance with the vulnerable function exposed is at risk; exploitation is limited chiefly by FTM's narrow enterprise-payments install base and whether that endpoint is actually reachable. No public exploit code has been identified at time of analysis, and IBM has released a patch.
XML external entity (XXE) injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an unauthenticated attacker positioned on an adjacent network segment to submit crafted XML that the product's parser resolves against external entities, resulting in disclosure of server-side files or server-side request forgery against internal services. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) requires no credentials and no user interaction, but the adjacent-network attack vector and the confidentiality-only impact mean exploitation depends heavily on whether an XML-accepting endpoint is reachable from an untrusted same-segment network and on what sensitive files or internal services are reachable from the server context. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), and IBM has published a patch advisory; despite the High score this is a moderate-priority issue that should not be over-prioritized relative to internet-reachable, integrity- or availability-impacting flaws.
Authentication bypass and sensitive-information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stem from a hard-coded cryptographic key (CWE-321) embedded in the product, scoring 8.1 (High) with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Because the key is embedded and therefore shared across deployments, an unauthenticated attacker who is positioned on the same adjacent network as an affected OpenShift deployment can bypass authentication and read or tamper with sensitive financial-transaction data, with no user interaction required; the assessment notes this is not confirmed as directly reachable from the public internet despite the description's 'remote attacker' phrasing. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let unauthenticated attackers execute unauthorized payment actions against the payment-action interface, compromising transaction integrity with a limited availability impact (CVSS 3.1 base 7.1, CWE-862). The assessed vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) means the attacker must already sit on an adjacent network - the same LAN segment, an established VPN, or the OpenShift cluster/service-mesh network - rather than reaching the service from the open Internet, so exposure is bounded by network placement even though no credentials or user interaction are required. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); this reads as a genuine but moderate-priority integrity issue rather than an inflated high-severity finding, and IBM has published a fix.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can expose financial transaction data to passive interception by an attacker who is positioned on the adjacent network path carrying the affected traffic. Only deployments where a sensitive channel lacks properly configured transport encryption (for example, TLS disabled or misconfigured) are exposed; where channels are protected end to end, the flaw does not arise. Cisco-style remote internet exploitation is not the scenario here, and no public exploit code or confirmed active exploitation was identified at time of analysis. Our independent assessment rates this as a real but low-priority issue, with an assessed vector of CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacent-network access plus a cleartext deployment are both required, making successful exploitation contingent on deployment configuration.
Sensitive information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stems from the product's use of a hard-coded or predictable cryptographic key (CWE-321). Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), an unauthenticated remote attacker who obtains that static key can read data the product intended to protect, with no integrity or availability impact. The real gate is acquiring or deriving the embedded key rather than defeating authentication: no public exploit identified at time of analysis, EPSS is only 0.26% (17th percentile), and CISA SSVC records exploitation as none with Automatable set to no, making this a moderate, not urgent, priority.
Hard-coded cryptographic keys and initialization vectors in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote authenticated attacker (CVSS 3.1 PR:L, 7.1 overall) to decrypt protected sensitive information and forge authentication tags, because the same static key material is baked into every deployment rather than generated per installation. Affected builds are the OpenShift-packaged FTM at 4.0.6.0 (including Interim Fixes 1 through 6) and, per ENISA EUVD, the 4.0.7.0 through 4.0.10.0 Interim Fix 06 range; the decisive prerequisite is compromise of a low-privilege account, and impact is primarily confidentiality with only partial integrity (C:H/I:L/A:N) and no availability loss. Exploitation is currently assessed as none - no public exploit code identified at time of analysis, EPSS only 0.22% (13th percentile), CISA SSVC exploitation "none", automatable "no" - which makes this a moderate-severity, lower-priority issue in practice.
Message forgery in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets remote, unauthenticated attackers send messages bearing forged cryptographic signatures that the platform improperly accepts as authentic, undermining the integrity of trusted transaction messaging (CWE-347, CVSS 7.5, integrity-only impact with no confidentiality or availability loss). Affected releases are the 4.0.6.0 line, including Interim Fixes 1 through 6, plus 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 06. Exploitation is remote and requires no authentication or user interaction (PR:N/UI:N) but demands that an attacker understand and correctly craft a message in FTM's expected format and that an FTM message interface be reachable; there is no public exploit identified at time of analysis (EPSS 0.19%, 9th percentile), CISA SSVC rates exploitation as none and automatable as no, and there is no KEV listing.
Remote code execution via ESQL command injection affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where externally supplied input is combined into ESQL statements without neutralization of special elements. Per IBM PSIRT scoring (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), an unauthenticated remote attacker who can reach a vulnerable FTM message flow that builds ESQL commands from attacker-controlled data can achieve full confidentiality, integrity, and availability impact within the FTM runtime and its connected resources. The high attack-complexity rating reflects a non-default precondition - typically a specific flow or configuration that routes untrusted data into ESQL - so exposure is limited to environments running FTM on OpenShift with such a flow. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift exposes transaction data, credentials, or other confidential payloads to anyone able to observe network traffic on the same segment. The issue affects deployments of FTM for OpenShift where the relevant transport is not wrapped in TLS; an unauthenticated attacker with an adjacent-network position (per the assessed vector PR:N, AV:A) can passively capture that traffic, though a successful capture depends on the specific unencrypted channel being in use (AC:H), which is why the independently assessed impact is limited to confidentiality only. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation, so this remains a low-real-world-priority issue despite the headline 7.5 (High) CVSS score.
Improper restriction of XML external entity references in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment - or elsewhere within the same cluster network - to read sensitive files and internal resources by submitting a crafted XML document to an FTM parsing endpoint. The assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) confirms the exploitation requirements: no credentials and no user interaction are needed, but the adjacent-network prerequisite rather than an internet-facing vector meaningfully narrows the attacker population, and impact is confined strictly to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis, no EPSS signal or CISA KEV listing is present in the provided data, and IBM has published a vendor advisory with a patch available for this CWE-611 flaw.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift fails to properly validate symbolic links, allowing an authenticated remote user to read files outside the intended path and disclose sensitive information held by the financial platform. The affected code path is reachable across the network (AV:N) but requires a valid FTM session (PR:L), and no public exploit code or confirmed active exploitation has been identified at time of analysis. IBM has published a vendor patch via its support portal; while the vendor-assigned CVSS of 9.9 implies a scope-changing, high-integrity and high-availability impact, independent analysis of the described weakness assesses it as an information-disclosure issue (file read) rather than full system compromise.
Unauthenticated remote code execution is possible in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the product improperly deserializes untrusted data (CWE-502), allowing a remote attacker who can reach a vulnerable endpoint to execute arbitrary code with the privileges of the affected service. IBM rates the flaw CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction and only network reachability are required, so any default-exposed FTM instance is at risk; the practical limiting factor is exposure, since FTM is specialized financial middleware normally deployed inside enterprise OpenShift clusters rather than on the public internet. Patch available per vendor advisory; no public exploit identified at time of analysis (no CISA KEV listing and no POC reporting in the available intelligence), though deserialization RCE is a well-understood and reliably weaponizable bug class once reachability exists.
Remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated network attacker run arbitrary code on affected deployments. The flaw is CWE-94 (improper control of code generation): user-controlled input is passed into a JavaScript `new Function()` constructor without neutralization, so injected input is compiled and executed as code. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) no credentials, privileges, or victim interaction are required - only network reach to the vulnerable code path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the practical limiting factor is exposure, since the specific input-handling routine must be reachable and FTM's narrow financial-services enterprise footprint constrains the target population.
Denial of service in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift: unsafe reflection handling of externally controlled input lets an unauthenticated remote attacker (CVSS 3.1 AV:N/AC:L/PR:N/UI:N) drive the service into an availability failure, scored A:H with no confidentiality or integrity impact for a base score of 7.5. Deployments affected are the 4.0.6.x through 4.0.10.0 releases listed by IBM prior to the Interim Fix 064 level. Exploitation pressure currently looks low - EPSS is 0.60% (47th percentile), CISA's SSVC decision framework rates exploitation 'none' and automatable 'no', and no public exploit code has been identified at time of analysis - but the practical limiter is exposure rather than exploit difficulty, since this financial middleware is normally run inside controlled OpenShift clusters instead of the open internet.
Path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, affecting builds from 4.0.6.0 through 4.0.10.0 Interim Fix 06 (Operator 4.4.6+20260807.081800), allows an unauthenticated remote attacker (PR:N/UI:N per the CVSS vector) to submit manipulated path input that the product fails to canonicalize and thereby read arbitrary files accessible to the FTM process. The impact is confidentiality-only - no write, code execution, or availability effect - and exploitation requires network reachability to the FTM application endpoint, so internal-only routes or network segmentation materially reduce exposure. A vendor patch is available via IBM's advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.35% (28th percentile), making this a moderate rather than urgent priority.
Authenticated remote code execution affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where a buffer overflow (out-of-bounds write) in an FTM component lets an attacker with valid low-privilege credentials submit crafted input and gain code execution in the containerized transaction platform. The vendor rates this 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment concurs on high confidentiality and integrity impact while treating the scope change as unproven (S:U). Exploitation requires authentication (PR:L) and is not considered reliably repeatable on the first attempt (AC:H), and no public exploit identified at time of analysis. A vendor patch is available per IBM advisory node/7288641, so organizations running FTM on OpenShift should treat this as a priority patch action for their FTM estate.
Remote, unauthenticated attackers who can reach the application endpoints of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can perform unauthorized actions because the software fails to properly authenticate requests and subsequently omits authorization checks. Affected deployments are those running versions 4.0.6.0 through 4.0.10.0 Interim Fix 064, including Operator 4.4.6+20260807.081800 and the 4.0.6.0 Refresh build, per the EUVD version list. Impact is confined to integrity - attackers can trigger unauthorized operations or modify data, but there is no confidentiality or availability consequence per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), and there is no public exploit identified at time of analysis, with EPSS at only 0.60% (47th percentile) and CISA SSVC recording no observed exploitation.
Server-side request forgery (CWE-918) in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift at affected levels allows an authenticated local attacker to coerce the FTM server into issuing attacker-influenced requests, yielding disclosure of sensitive information and enabling unauthorized actions - rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), high confidentiality and integrity impact with no availability impact. Exploitation requires a deployed affected FTM instance plus valid low-privilege authenticated access reachable locally (the vector is local, not internet-facing, and user interaction is not required); no public exploit code has been identified at time of analysis and EPSS is 0.15% (5th percentile), while CISA SSVC records Exploitation: none and Automatable: no. This is a moderate-priority, not a drop-everything, issue: the niche financial middleware footprint, locally-scoped vector, and mandatory authentication mean an unauthenticated external attacker cannot exploit it directly against a default internet-facing posture. A vendor patch is available.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains a command execution flaw stemming from functionality being pulled in from an untrusted control sphere (CWE-829), so an attacker who already holds a low-privilege foothold in the OpenShift environment hosting the product can influence the untrusted source and cause arbitrary commands to run within the FTM process context. The attack is local (AV:L, PR:L, UI:N) - there is no unauthenticated or internet-facing path to the flaw - which limits exposure to environments that actually run the affected FTM build. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the vendor has published a patch, and the vendor base score of 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope-change assumption that independent assessment does not confirm, so real-world severity should be treated as high-but-localized rather than remotely critical.
Privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote authenticated attacker who already holds a privileged account exceed the permissions assigned to that account, with high impact across confidentiality, integrity and availability. IBM rates it 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), a score driven mainly by the Scope-Change flag; our independent assessment preserves the full CIA impact but treats scope as unchanged, because the high starting-privilege requirement narrows the realistic attacker population to insiders or holders of compromised privileged credentials, and the deployment footprint is limited to organizations running FTM on OpenShift. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor patch advisory.
Hard-coded credentials embedded in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let a local, low-privileged attacker - someone with at least an account, shell, pod, or container context in the deployment - reach a privileged FTM interface or data store and both read sensitive information and modify transaction data. Impacted releases include FTM for OpenShift 4.0.6.0 through the 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800), plus 4.0.7.0, 4.0.8.0, 4.0.9.0, and 4.0.10.0 Interim Fix 064. The issue is not remotely exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1), is not listed in CISA KEV, has no public exploit identified at time of analysis, and carries an EPSS of 0.14% (3rd percentile), keeping realistic risk moderate and largely confined to insiders or attackers who already hold a local foothold.
Local credential exposure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an already-authenticated, low-privilege local user to read insufficiently protected credentials and then use them to perform unauthorized actions against the environment, yielding high confidentiality and integrity impact with no availability impact. Only deployments running FTM for Red Hat OpenShift 4.0.6.0 through 4.0.10.0 (including the 0.6.0 Refresh build with Operator 4.4.6+20260807.081800 and 4.0.10.0 Interim Fix 064) are affected. Exploitation requires local access plus a valid low-privilege identity; no public exploit code has been identified at time of analysis (EPSS 0.14%, 4th percentile), and CISA SSVC records no known exploitation.
Deserialization of untrusted data in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated attacker who already has network reachability to the affected component from an adjacent network segment execute arbitrary code with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). The exposure prerequisite is meaningful: the flaw is reachable from a neighboring position such as a compromised pod, sidecar or host inside the same OpenShift cluster or VLAN, not directly from the public internet, and no authentication or user interaction is required once that path is reachable. At the time of analysis there is no public exploit code identified and no evidence of confirmed active exploitation (no CISA KEV listing); IBM has published a vendor fix via its support advisory, so the primary risk window is the interval between advisory release and patch deployment.
Remote code execution in IBM FTM for Red Hat OpenShift is possible when an authenticated attacker submits a manipulated quantity value to a vulnerable feature, causing an out-of-bounds write (CWE-787) that can lead to arbitrary code execution. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with full confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis; a vendor patch is available via IBM support node 7288641.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can be driven into performing unauthorized actions by remote, unauthenticated attackers because its HTTP method-based security constraints do not cover every verb, allowing requests that fall outside the configured constraint set to reach protected functions. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) and CWE-306 assignment confirm a low-complexity, network-reachable missing-authentication defect with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a patch advisory for the affected product line.
Cleartext transmission of sensitive or security-critical data by IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a network-positioned attacker read that traffic by passively sniffing the communication channel, resulting in high confidentiality loss without any integrity or availability impact. Affected deployments span the 4.0.6.0 release line (including the 4.0.6.0.0.6.0 Refresh, Operator 4.4.6+20260807.081800) through 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 064. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit code has been identified; EPSS is low at 0.20% (10th percentile), and CISA's SSVC assessment records exploitation: none, automatable: no. The practical barrier is the attacker's required vantage point on the traffic path, which our assessment reflects by treating attack complexity as high (AV:N/AC:H/PR:N/UI:N) rather than the vendor-published AC:L, making this a moderate rather than top-tier priority; a vendor patch is available.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote, unauthenticated attacker to view and modify sensitive transaction data and to degrade or disrupt the service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation needs only network reachability to the FTM service with no credentials and no user interaction, which is why IBM rates it 9.8 - but real-world priority is tempered by a low EPSS score of 0.38% (32nd percentile), CISA SSVC 'Exploitation: none', and an SSVC 'partial' technical impact that suggests the achievable view/modify/DoS effect may be narrower than the full-impact CVSS rating implies. No public exploit code has been identified at time of analysis, and deployment exposure is the main gate: FTM for OpenShift is typically confined to segmented financial-institution networks rather than being internet-facing.
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even a low-privileged account read and modify resources outside their granted permissions, because the product's RBAC permission definitions rely on wildcards instead of explicit resource scoping. IBM scores this 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), while our independent assessment rates it 8.8 with Scope:Unchanged, meaning the practical severity is high but below the vendor's critical rating; exploitation still requires a valid account and a reachable Concert instance. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation (not in CISA KEV), but IBM has published a vendor patch at support node 7288830.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only low-level privileges to execute arbitrary operating-system commands on the affected deployment, giving full compromise of host confidentiality, integrity and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a valid account and network reachability to the DataStage service, plus the ability to reach a parameter or job-input path whose value is passed into a shell command without neutralization; no user interaction is needed and complexity is rated low. At time of analysis no public exploit code and no confirmed active exploitation were identified, and IBM has published a vendor patch via its support advisory.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an attacker who holds a valid, low-privileged account to inject and execute arbitrary operating system commands through the product's command-handling logic, giving full compromise of confidentiality, integrity, and availability on the affected deployment. The flaw is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable and requires no user interaction, but it is gated behind authentication - making stolen credentials or a malicious insider the realistic threat model rather than anonymous internet-wide exploitation. A vendor patch is available from IBM, and no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in the px-runtime component of IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated, low-privilege remote attacker to execute arbitrary operating system commands on the affected host, with full loss of confidentiality, integrity, and availability. Exploitation requires only valid credentials on the Cloud Pak for Data instance and network reachability to the vulnerable component (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8); it is not exploitable by unauthenticated users. No public exploit code has been identified at time of analysis, but IBM has published a vendor patch, and the low complexity of the flaw combined with high impact makes prompt upgrading advisable.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-privileged Cloud Pak for Data account execute arbitrary operating system commands on the affected node, resulting in full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) with a CVSS 3.1 base score of 8.8. Exploitation is network-reachable and low-complexity with no user interaction (AV:N/AC:L/PR:L/UI:N), but it is gated behind a valid authenticated account that can reach the DataStage service, so exposure is limited to authenticated users of the 5.4.0.0 build. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; a vendor patch is available, so patched deployments are not exposed.
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid account plant special elements in a DataStage input path that are passed unsanitized into an operating-system command, resulting in arbitrary command execution with the privileges of the DataStage service. The prerequisite is a legitimate authenticated session (CVSS PR:L) on a network-reachable instance (AV:N/AC:L, UI:N), which limits realistic exposure to authorized users, compromised credentials, or malicious insiders on unpatched 5.4.0.0 deployments. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), but the vendor rates impact at 9.9 and a vendor patch is already available, so urgency is driven mainly by patch adoption rather than observed exploitation.
Authenticated SQL injection in IBM Guardium Data Protection 12.2 allows a high-privilege administrator to extract sensitive information from the appliance's underlying database by supplying malformed input to a specific application parameter that fails to neutralize SQL special elements. The attacker must already hold an authenticated management-console session with elevated privileges (CVSS PR:H), so exploitation is limited to trusted administrators or attackers who have already compromised admin credentials; no user interaction is required and the interface is network-reachable. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, making this a moderate-risk, targeted issue rather than a mass-exploitation candidate; a vendor patch is available.
Authorization bypass in IBM Guardium Data Protection 12.2 lets remote, unauthenticated network attackers (CVSS vector AV:N/PR:N/UI:N) reach the product's management/web interface and sidestep intended authorization checks, granting access to data-protection functions they should not be able to invoke. IBM scores the flaw 8.1 (HIGH) with full unscoped impact (C:H/I:H/A:H) and AC:H, while our independent assessment keeps the same unauthenticated network vector but lowers the assessed impact to C:L/I:L/A:L - meaning the practical effect is more likely unauthorized read/modification of limited functionality than complete compromise, with the high complexity reflecting a non-trivial precondition (a specific request state, timing, or authorization configuration) that the vendor does not disclose. No public exploit identified at time of analysis, and a vendor fix is available through IBM support node 7288035.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets a remote attacker who can reach the web management interface place script into an input that the application reflects into a generated page without output encoding, so JavaScript runs in the browser of any user who views that page. The vendor describes this as arbitrary code execution and scores it 8.1, but the weakness class is CWE-79 rather than a server-side code-execution primitive; our independent assessment rates it materially lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) because realistic exploitation needs a low-privileged foothold plus a victim with console access loading the crafted page, bounding impact to that user's session. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV. Treat this as a high-CVSS-but-likely-overstated finding centered on console session abuse rather than host compromise.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user with access to the management interface inject script that executes in the browser of another logged-in user who views the poisoned page, enabling session theft or actions performed with the victim's privileges. The vendor rates this CVSS 8.9 (High) with scope change, but the CWE-79 classification and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) identify it as an input-neutralization/XSS flaw rather than the remote code execution implied by some tagging; exploitation requires a valid account (PR:L, authenticated) plus victim interaction (UI:R) and does not work unauthenticated. No public exploit code and no CISA KEV listing were identified at time of analysis, and the vendor has published a patch advisory, so risk is real but constrained by the authentication and user-interaction prerequisites.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote, authenticated attacker holding only a low-privilege session to read sensitive information out of the product's backend database by supplying crafted input to a request parameter that is concatenated into a SQL command without neutralization. No user interaction is required and no public exploit code has been identified at time of analysis, so the practical risk depends on who can already reach the management interface - which is normally deployed on segmented internal networks, keeping broad internet-facing exposure low. Impact is confined to confidentiality (information disclosure); there is no integrity or availability effect, and only version 12.2 is named as affected.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an authenticated, low-privileged user with existing access to the appliance host to raise their privileges to a higher level, affecting confidentiality, integrity and availability of the platform. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a pre-existing local account and low complexity but no user interaction; it is an escalation step rather than a remote entry vector, so risk is concentrated on collector/aggregator hosts where untrusted or lower-tier accounts or shells already exist. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; this is a genuine but moderate-priority local privilege escalation rather than an actively exploited campaign.
Arbitrary code execution is possible on IBM Guardium Data Protection 12.2 when a remote attacker who already holds high-privilege credentials abuses a file-handling feature that fails to constrain a user-supplied pathname to its intended restricted directory (CWE-22). The requirement for HIGH privileges (PR:H) on the management interface is the primary limiting factor, restricting realistic exploitation to trusted administrative accounts on an appliance that is normally deployed on internal or segmented networks, though no user interaction is required (UI:N). The vendor has published a fix advisory, and no public exploit identified at time of analysis (no CISA KEV listing and no published proof-of-concept in the supplied intelligence).
OS command injection in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the affected appliance, giving full compromise of confidentiality, integrity, and availability (CVSS 8.1, CWE-78). The assessed vector (AV:N/AC:H/PR:N/UI:N) means no credentials and no user interaction are needed, but exploitation is not a single deterministic request - the attacker must first satisfy a specific precondition such as a crafted payload meeting input constraints or a particular application/timing state, and the target's vulnerable network service must be reachable, which is uncommon for a security-monitoring appliance that is typically segmented. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available per the referenced IBM support advisory.
Cross-site request forgery in IBM Guardium Data Protection 12.2 lets a remote attacker with no credentials (CVSS vector PR:N) induce a currently authenticated user's browser into sending forged requests that bypass security restrictions and perform privileged actions in that user's context. Exploitation is not automatic: it requires the victim to be logged into the Guardium web interface (ideally as an administrator) and to be lured into loading attacker-controlled content while that session is live (UI:R), so it is best modeled as an attacker-assisted integrity abuse of an existing session rather than a self-contained compromise. IBM has acknowledged the flaw (CWE-352) and shipped a vendor fix, but no public exploit code has been identified at time of analysis and the issue does not appear on CISA KEV, so exploitation is not confirmed in the wild; successful attacks can alter configuration or security settings through the victim's own authorized privileges, but the attacker cannot read responses returned to that session.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows a low-privileged local attacker to execute arbitrary commands as root by exploiting insufficient argument validation in the SUID-root nmap_wrapper binary on the Collector appliance, resulting in full compromise of the Collector. The vulnerability requires existing low-privileged local shell access to the Collector and is not remotely exploitable. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is concatenated into a SQL statement without proper neutralization, enabling execution of arbitrary SQL commands with full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). Per the assessed vector, no credentials and no user interaction are required, so any party who can reach the affected interface over the network can attempt exploitation; the practical barrier is deployment exposure, since Guardium management interfaces are normally placed on segmented internal or security-monitoring networks rather than being internet-facing. There is no public exploit code identified at time of analysis and the vulnerability is not listed in CISA KEV, but successful exploitation could allow reading or altering the data Guardium is entrusted to protect, which makes internal-network reachability the key risk factor. The specific injectable endpoint or parameter is not named in the available description, and if the flaw is second-order rather than first-order, real-world exploitation would require more steps than the AC:L rating implies. No EPSS score was supplied with the source data.
IBM Guardium Data Protection 12.2 accepts TLS peer certificates it should reject, letting an attacker positioned on the network path impersonate a trusted endpoint and bypass the security restrictions the encrypted channel is meant to enforce. The vector is PR:N and UI:N, so no credentials or user action are needed, but the practical barrier is the MITM foothold itself - ARP or DNS spoofing, a rogue access point, or a compromised intermediate segment - which is exactly why the score carries AC:H and why properly segmented deployments are largely shielded. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor fix.
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-reachable attackers to invoke privileged load-balancer operations, compromising the integrity and availability of the affected deployment. The flaw is rated 9.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and maps to CWE-306, so no credentials or user interaction are required; the practical barrier is that the Guardium management interface exposing the servlet must be reachable across the network, and such interfaces are usually confined to segmented internal networks. Impact is concentrated on load-balancer control operations rather than broad data exposure (confidentiality impact is low), and no public exploit identified at time of analysis; the issue is not listed in CISA KEV. IBM has published a patched release through its support advisory.
Cross-site request forgery in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 8.1) to bypass security restrictions by riding an already-authenticated administrator's browser session, producing high integrity impact on protected configuration. The attacker supplies no credentials of their own, but exploitation requires a victim who is currently logged in to Guardium to be tricked into loading attacker-controlled web content while that session is live, so no public exploit code has been identified at time of analysis. IBM has published a vendor patch via support page node 7288035, and deployments enforcing anti-CSRF tokens, SameSite cookies, or re-authentication for sensitive actions are materially less exposed.
IBM Guardium Data Protection 12.2 permits a remote authenticated attacker to bypass security restrictions through an improper authorization check, compromising integrity with limited confidentiality and availability impact. The flaw is network reachable at low complexity and requires a valid low-privilege session but no user interaction; no public exploit identified at time of analysis. Affected deployments should apply the vendor patch referenced in IBM support node 7288035.
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the ChangeTrackerServlet, which is missing authentication (CWE-306). The vendor CVSS 3.1 vector rates this 9.9 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L), and the independent assessment preserves the unauthenticated network-reachable nature while treating scope as unchanged; no public exploit was identified at time of analysis and there is no CISA KEV confirmation. IBM has published patch information, so affected deployments should be updated and have network access to the management web tier restricted until patched.
Cross-site scripting in IBM Guardium Data Protection 12.2 allows an attacker holding valid low-privilege web interface credentials to inject content that executes scripts in a second, typically higher-privileged user's browser session when that user views the improperly neutralized page. Although the vendor description and the 'RCE' tag suggest arbitrary code execution, CWE-79 (improper neutralization of input during web page generation) and the assessed vector restrict impact to the victim's browser session in the web application's security context, not native code execution on the appliance, and exploitation requires both authenticated access and victim interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a patch advisory at https://www.ibm.com/support/pages/node/7288035.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote attacker who already holds a valid low-privilege session to execute arbitrary SQL commands against the appliance's backend database by supplying crafted input to a request parameter that is not properly neutralized before being used in a SQL statement. IBM rates this CVSS 9.1, driven by a high confidentiality impact on a platform whose core function is monitoring and protecting sensitive databases, though exploitation prerequisites are meaningful: the attacker must be authenticated (CVSS vector PR:L), needs network reach to the management interface, and only version 12.2 is named as affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, so risk is concentrated in environments where low-privilege credentials can be obtained or are broadly distributed, and a vendor patch is available.
OS command injection in IBM Guardium Data Protection 12.2 allows a privileged authenticated attacker to execute arbitrary commands with root-level privileges through the Universal Connector plugin upload feature. The flaw carries a CVSS 3.1 base score of 7.2 (HIGH) under the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network reachability and full confidentiality, integrity and availability impact, though exploitation is gated behind a high-privilege account. No public exploit code is identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Cross-site scripting (CWE-79) in IBM Guardium Data Protection 12.2 allows an authenticated remote user to supply crafted input to the web management console that is later rendered by a second, separate user's browser, executing attacker-controlled script in that victim's session. Exploitation requires two distinct conditions - a valid Guardium account to plant the payload and a privileged victim who loads the affected page - so it is not self-executing and cannot be triggered before authentication; despite the vendor description's reference to 'arbitrary code', the demonstrated impact is bounded to client-side script execution within the victim's browser session (session/token theft, forged UI actions, data exfiltration from the console), not server-side command execution. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and the vendor's 8.9 CVSS score overstates real-world risk relative to the assessed vector (PR:L/UI:R, confidentiality and integrity impact limited, no availability impact).
Improper authorization in IBM Guardium Data Protection 12.2 lets a remote attacker who already holds a valid low-privilege account reach functions or data that the platform's access controls are supposed to withhold, effectively bypassing security restrictions. The defect maps to CWE-285 (Improper Authorization); IBM rates it 7.4 while our independent assessment scores it 7.4-class only with scope unchanged, yielding a moderate 6.3-level risk because confidentiality, integrity, and availability impacts are all low. Authentication is required (CVSS vector PR:L), no user interaction is needed, and no public exploit code has been identified at time of analysis. A vendor patch is available via IBM support node 7288035, so remediation is straightforward for organizations that can schedule an upgrade.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL commands against the appliance's back-end database, and the vendor rates it Critical (9.9) on a scope-changed vector while our independent assessment retains high impact on confidentiality, integrity, and availability on a scope-unchanged basis. Exploitation requires valid low-privilege credentials to the Guardium web/management console (CVSS PR:L) with no user interaction (UI:N), so a standard operator or auditor-level account is enough to reach the vulnerable query path, and Guardium is normally deployed on internal management networks rather than exposed to the internet, which meaningfully constrains realistic exposure. No public exploit code exists and there is no evidence of active exploitation at time of analysis (no CISA KEV listing), and a vendor patch is available.
Low-privileged authenticated users of IBM Guardium Data Protection 12.2 can extract hardcoded product master secrets embedded in the hardware_assess and obstore binaries, then use those secrets to reach the product's internal database and read sensitive system information. Exploitation is gated by an existing authenticated account on the appliance plus the ability to access the affected on-box binaries, so the realized attack surface is local/CLI-oriented rather than purely remote, and there is no public exploit identified at time of analysis. The vendor's 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates exposure for a hardcoded-credentials weakness; an independent assessment of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N is more consistent with a locally reachable, confidentiality-dominant issue that is brute-force gated by pre-existing authenticated access.
Command injection in the IBM Guardium Data Protection 12.2 CLI certificate S/MIME recipient deletion routine allows an authenticated user holding a privileged CLI role to execute arbitrary shell commands with root privileges on the appliance. The flaw sits in a specific certificate/S/MIME management code path and requires high-privilege authentication plus interactive access to the command-line interface, so it is best characterized as an access-gated privilege escalation and post-compromise escalation primitive rather than a mass-exploitation threat. Patch status is "Patch available per vendor advisory" (IBM support page node/7288034); no public exploit identified at time of analysis, and no EPSS score was supplied with the intelligence feed.
Command injection in IBM Guardium Data Protection 12.2 allows an authenticated, highly privileged CLI user to execute arbitrary operating-system commands as root, escaping the restricted certificate-export shell (scope change) and fully compromising confidentiality, integrity, and availability. The flaw is CWE-78 (OS command injection) in the certificate export CLI path and carries a vendor CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation is gated behind privileged CLI authentication, and no public exploit code or confirmed active exploitation has been identified at time of analysis; IBM has released a vendor patch.
Command injection in IBM Guardium Data Protection 12.2 lets an authenticated attacker who can influence security policy alert text execute arbitrary operating system commands with root privileges through the SNMP alert notification functionality. Exploitation is gated behind valid credentials with policy-authoring capability and requires that the deployment actually uses SNMP alerting, so this is a privileged-insider or compromised-account risk rather than an opportunistic remote attack; no public exploit code was identified at time of analysis and CISA SSVC records no known exploitation. IBM has published a vendor patch, and the EPSS score is low (0.67%, ~50th percentile), consistent with a credible high-impact issue that is not an emergency.
Path traversal in IBM Guardium Data Protection 12.2's Datasource REST component allows authenticated remote attackers with low privileges to delete arbitrary files, causing denial of service and integrity impact. The flaw requires network access to the REST API and valid credentials (CVSS PR:L), with no user interaction. No public exploit code or active exploitation has been identified at time of analysis, but a vendor patch is available.
Unauthenticated attackers on the management network can crash the ASMI web interface on IBM Server Firmware by sending a malformed HTTPS request, causing a temporary denial of service that may become sustained with repeated exploitation. The vulnerability is an out-of-bounds read (CWE-125) with a CVSS score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H); while the interface restarts automatically after a single crash, sustained attacks could lead to a persistent loss of management access. No public exploit identified at time of analysis; this is a moderate-risk availability flaw, not a critical priority, and exposure is limited to attackers already on the management network segment.
Arbitrary code execution in IBM Guardium Data Protection 12.2 is reachable by an authenticated, high-privilege user who can write to or otherwise influence the Quartz JDBC job store, because the scheduler deserializes stored job data without validating the Java object graph it reconstructs. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2) requires valid privileged credentials but no victim interaction, and successful exploitation gives full loss of confidentiality, integrity, and availability on the affected server. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, but IBM has published a vendor patch to remediate the issue.
IBM Guardium Data Protection 12.2 stores internal REST service-account credentials in a reversible, plaintext-equivalent format (CWE-256), so an authenticated attacker who can read that stored value can recover the underlying password and mint an administrative REST access token. The flaw is network-reachable but requires a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the ability to reach the credential storage location, which makes it condition-dependent rather than mass-exploitable - SSVC rates exploitation as none and automatable as no, EPSS sits at 0.24% (13th percentile), and no public exploit code or CISA KEV entry is associated with the issue. A vendor patch is available, so the practical risk is concentrated in unpatched 12.2 deployments where low-privileged or delegated accounts exist.
Authenticated path traversal in IBM Guardium Data Protection 12.2 allows a remote low-privilege user with a valid management-interface session to read sensitive information, delete arbitrary files, or execute arbitrary code. The flaw is a CWE-22 directory-restriction bypass; SSVC rates exploitation as non-automatable, suggesting targeted rather than mass-scanning abuse, and no public exploit was identified at time of analysis (EPSS 0.54%). Patch available per vendor advisory.
Authenticated command injection in IBM Guardium Data Protection 12.2 allows a user who can reach the GIM (Guardium Installation Manager) bundle import functionality to supply a crafted bundle whose contents cause attacker-controlled arguments to be passed to the underlying tar command, resulting in arbitrary command execution with elevated privileges on the Central Manager. The flaw is network-reachable and requires only low-privileged authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) with no victim user interaction, so any account able to trigger a bundle import should be considered capable of full compromise of the Central Manager. No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor has published a fix advisory.
Authenticated path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote user holding valid low-privileged credentials to reach files outside the directory the application intends to restrict, producing a high integrity impact (I:H) and a limited availability impact (A:L) while the published vector shows no direct confidentiality loss. Exploitation is remote (AV:N) but rated high complexity (AC:H), meaning success depends on target-specific conditions such as exact file paths or platform state, and it requires a valid account (PR:L) with no user interaction (UI:N). No public exploit code or CISA KEV entry was identified at time of analysis, so this is a real but moderate-priority flaw for unpatched 5.4.0.0 deployments; IBM has published a fix through its support advisory.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a low-privileged user with network access to the service reach an unsafe deserialization sink and execute arbitrary code in the context of the affected component. The issue is CWE-502 (deserialization of untrusted data) rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so a successful attack yields high confidentiality, integrity and availability impact with no user interaction required. Exploitation requires previously obtained valid CP4D/DataStage credentials (PR:L) and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as none and the attack as not automatable, though the technical impact is rated total.
Authenticated command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker with valid low-privileged credentials to execute arbitrary operating-system commands, potentially compromising confidentiality, integrity, and availability (CVSS 8.8). Exploitation requires network reachability to the DataStage/CP4D interface and the ability to supply input that is mapped into an unneutralized environment variable (CWE-78); no user interaction is needed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' with total technical impact, so this is a genuine high-severity finding but not an emergency.
Server-side request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker to make the server issue requests to internal endpoints and return sensitive information by supplying a manipulated X-Forwarded-Proto header that the application fails to validate. Exploitation requires a valid account on the platform (CVSS PR:L) with network access to the DataStage web interface; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The vendor/NVD CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reads as Critical, but the independent assessment scores it C:H/I:N - a confidentiality-only SSRF whose real-world impact depends on which internal services the DataStage host can reach and what those endpoints expose.
Command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only a low-privilege account to execute arbitrary OS commands on the host, with high impact to confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires valid credentials and the ability to reach a code path that constructs an operating system command from user-supplied input without neutralizing shell special elements; no user interaction is needed, and the deployment context - an internal enterprise ETL service rather than an internet-facing endpoint - plus the narrow affected version materially constrain real-world exposure. No public exploit code has been identified and there is no confirmed active exploitation (not listed in CISA KEV); a vendor patch is available per IBM's advisory.
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low privileges to execute arbitrary operating system commands by exploiting a path traversal flaw (CWE-22). The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a High severity score of 8.8, reflecting full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and a vendor patch is available.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements that are passed into an OS command, allowing a remote attacker holding any low-privilege platform account to execute arbitrary operating-system commands on the DataStage host with the privileges of the vulnerable service. Rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exposure is gated by authentication: there is no anonymous internet-facing path, but multi-tenant deployments, shared service accounts, or any compromised low-privileged credential are sufficient to reach full command execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, while a vendor patch is available.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with only low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) run arbitrary operating system commands on the affected platform, yielding high confidentiality, integrity, and availability impact for an overall CVSS base score of 8.8. Exploitation requires a valid CP4D session and access to the DataStage functionality that forwards attacker-controlled input into a shell command without sanitization; no public exploit identified at time of analysis, and IBM has published a vendor fix. Only the 5.4.0.0 build is explicitly named as affected, so patched builds referenced in IBM's advisory remove the exposure.
SQL injection in IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 allows remote unauthenticated attackers to view, add, modify, or delete back-end database information. The flaw (CWE-89) carries a CVSS 3.1 base score of 8.6, with an independent assessment vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicating high confidentiality and integrity impact and low availability impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch is available via IBM support.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only a low-privilege account to execute arbitrary operating-system commands on the underlying host, fully compromising the confidentiality, integrity and availability of the affected deployment. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) confirms network reachability, low attack complexity, mandatory authentication at the low privilege level and no user interaction, matching the independent assessment that this is a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk artifact. No public exploit code was identified at time of analysis, and a vendor patch is available through IBM support node 7288649; accordingly, real-world risk is concentrated in reachable, unpatched 5.4.0.0 deployments rather than in broad opportunistic exploitation.
Information disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read files and reach resources outside the application's security scope by submitting crafted XML to an XML-processing function (CWE-611 XML external entity injection). The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N rates this 7.7 High: confidentiality impact is high with a scope change, but there is no integrity or availability effect, meaning the outcome is data exposure rather than code execution or service disruption. Exploitation requires a valid low-privilege DataStage account and network reachability to the affected XML handling surface; no user interaction is needed, and no public exploit identified at time of analysis. Patch available per vendor advisory (IBM support page node/7288649).
Credential disclosure in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated user recover encrypted credentials that were issued for other users or environments, because the product mishandles encrypted credential material. Exploitation is network-reachable and requires no user interaction, but it does require a valid low-privileged account on the deployment (CVSS 3.1: 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), so the risk is a bounded confidentiality exposure that grows with the number of users and environments sharing the cluster rather than a remotely exploitable anonymous flaw; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV). A vendor patch is available per IBM's advisory.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker with only low-privilege credentials run arbitrary commands on the underlying host, yielding full confidentiality, integrity, and availability impact. The flaw requires network reachability to the DataStage service but no user interaction and no non-default configuration, so any valid low-privilege account is sufficient to attempt exploitation; the platform is a specialized enterprise deployment typically placed behind organizational access controls rather than exposed to the internet. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV), but a vendor patch is available per IBM's advisory, and the low attack complexity and high impact make prompt patching advisable.
Remote authenticated code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 is possible because connector property values are not properly escaped when OSH scripts are generated, allowing an attacker with a valid account and the ability to define or edit connector properties to inject commands that execute with DataStage privileges. The flaw is network-reachable, low-complexity, and requires no victim interaction, but it requires authentication (CVSS 3.1 PR:L) and is rated 8.8 HIGH (C:H/I:H/A:H). No public exploit code or confirmed active exploitation was identified in the provided intelligence, and a vendor patch is available via IBM support.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker holding low-privilege credentials to execute arbitrary commands on the underlying system, with high impact to confidentiality, integrity, and availability. The flaw stems from improper neutralization of special elements used in OS commands (CWE-78), and exploitation requires a valid authenticated session plus reachability of the specific DataStage feature that passes user-supplied input into a shell command; no user interaction is needed. No public exploit code has been identified and there is no evidence of active exploitation (not listed in CISA KEV), but a vendor patch is available and the issue should be treated as a genuine high-priority fix rather than a high-CVSS-but-low-risk artifact.
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged account on the host execute arbitrary code by manipulating the search path used when Concert spawns operating system commands. Because Concert does not fully qualify the executable paths it invokes, a malicious binary placed earlier in the search order is executed with the privileges of the Concert process. The flaw is scored CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires local system access plus the ability to influence path resolution; no public exploit code has been identified at time of analysis and this CVE is not in CISA KEV. A vendor patch is available.
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow corrupt heap memory, crash the application, or potentially hijack control flow for code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a vendor fix (advisory node 7288830). The vendor-published vector claims unauthenticated network exploitation at 9.8, but our assessment scores the issue AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H: the practical attack is high-complexity, requires an authenticated position to supply the malicious input, and the specific trigger surface is unconfirmed, so real-world severity is materially lower than the published base score suggests.
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access to the host trigger a double free (CWE-415) and, with heap grooming, execute arbitrary code in the context of the affected process. Exploitation is authenticated and local only - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8) - with full confidentiality, integrity, and availability impact when successful; no public exploit identified at time of analysis. IBM has published a vendor advisory and patch guidance at https://www.ibm.com/support/pages/node/7288830.
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that overflows a buffer and achieves arbitrary code execution under the privileges of the affected process, matching the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. IBM's own advisory scores the issue 9.8 with a network/unauthenticated vector (AV:N/AC:L/PR:N/UI:N), but the vendor description explicitly states a 'local user' is required, so realistic exposure is confined to systems where an attacker already has a local account - a foothold-to-full-compromise escalation rather than a pre-authentication remote RCE. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM has published an advisory with a vendor-supplied fix.
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service send specially crafted input that is incorporated into operating-system commands, executing arbitrary commands with the privileges of the Concert application. The vulnerability is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction, and no special conditions are required - only network reachability of an unpatched instance. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation appears opportunistic-dependent rather than confirmed in the wild, but IBM has published a vendor fix, so the priority is to patch exposed instances before exploit code or scanning activity emerges.
Unauthenticated remote attackers can manipulate SQL database queries in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, giving them a high-integrity impact with limited confidentiality and availability effects on affected payments-processing deployments. The flaw is a boolean-based blind SQL injection rooted in improper neutralization of special elements in a boolean expression (CWE-74), exploitable over the network with low complexity and no authentication or user interaction per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (base 8.2). No public exploit code has been identified and there is no confirmation of active exploitation; IBM has published a vendor advisory containing patch guidance, but affected version ranges are expressed as a wildcard CPE, so defenders must match their specific build against IBM's advisory to determine exposure.
Unauthenticated insertion of malicious runbook content into the vector database backing IBM Financial Transaction Manager (FTM) for Red Hat OpenShift's AI agent allows retrieval-augmented generation (RAG) poisoning that can steer AI-driven MCP tool calls toward unauthorized payment actions or exfiltration of payment data. IBM self-rates the issue CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), reflecting unauthenticated network reachability and low attack complexity rather than high per-impact severity, since the realized effect is mediated by LLM behavior and is probabilistic rather than deterministic. The flaw is rooted in CWE-74 at api.vectordb.runbooks.js:51; no public exploit code identified at time of analysis and the issue is not tied to confirmed active exploitation, with exposure limited to deployments where the FTM AI agent endpoint is network-accessible and the agent has MCP tools wired to payment-affecting actions.
Stored cross-site scripting in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker with adjacent-network positioning to plant script inside stored network acknowledgement data, which then executes in the browsers of authenticated FTM operators and can lead to session hijacking and unauthorised operator-level payment actions. The flaw sits in the NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42), which renders stored acknowledgement content without adequate output encoding. The vendor rates it 9.3, while the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, where the requirement that a legitimate operator open the affected view is the practical limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis, but the payments context and scope change keep the impact ceiling high.
Unauthenticated remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment to send a crafted Java-serialized payload to the PayDir Business Rules Manager RMI SSL endpoint and execute arbitrary code on the target host. Because the vulnerable service is exposed with no authentication and no user interaction required (CVSS 8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation exposes all PayDir credentials and enables manipulation of payment business rules, producing high confidentiality and integrity impact. The adjacency requirement is the primary limiting factor, and no public exploit identified at time of analysis; a vendor patch is available per the IBM advisory.
Missing authentication for a critical function in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows a remote, unauthenticated attacker to read sensitive information and modify system configurations on an affected deployment. With CVSS 7.3 (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are required, so any network-reachable FTM instance with the vulnerable function exposed is at risk; exploitation is limited chiefly by FTM's narrow enterprise-payments install base and whether that endpoint is actually reachable. No public exploit code has been identified at time of analysis, and IBM has released a patch.
XML external entity (XXE) injection in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an unauthenticated attacker positioned on an adjacent network segment to submit crafted XML that the product's parser resolves against external entities, resulting in disclosure of server-side files or server-side request forgery against internal services. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) requires no credentials and no user interaction, but the adjacent-network attack vector and the confidentiality-only impact mean exploitation depends heavily on whether an XML-accepting endpoint is reachable from an untrusted same-segment network and on what sensitive files or internal services are reachable from the server context. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (no CISA KEV listing), and IBM has published a patch advisory; despite the High score this is a moderate-priority issue that should not be over-prioritized relative to internet-reachable, integrity- or availability-impacting flaws.
Authentication bypass and sensitive-information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stem from a hard-coded cryptographic key (CWE-321) embedded in the product, scoring 8.1 (High) with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Because the key is embedded and therefore shared across deployments, an unauthenticated attacker who is positioned on the same adjacent network as an affected OpenShift deployment can bypass authentication and read or tamper with sensitive financial-transaction data, with no user interaction required; the assessment notes this is not confirmed as directly reachable from the public internet despite the description's 'remote attacker' phrasing. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let unauthenticated attackers execute unauthorized payment actions against the payment-action interface, compromising transaction integrity with a limited availability impact (CVSS 3.1 base 7.1, CWE-862). The assessed vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) means the attacker must already sit on an adjacent network - the same LAN segment, an established VPN, or the OpenShift cluster/service-mesh network - rather than reaching the service from the open Internet, so exposure is bounded by network placement even though no credentials or user interaction are required. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); this reads as a genuine but moderate-priority integrity issue rather than an inflated high-severity finding, and IBM has published a fix.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can expose financial transaction data to passive interception by an attacker who is positioned on the adjacent network path carrying the affected traffic. Only deployments where a sensitive channel lacks properly configured transport encryption (for example, TLS disabled or misconfigured) are exposed; where channels are protected end to end, the flaw does not arise. Cisco-style remote internet exploitation is not the scenario here, and no public exploit code or confirmed active exploitation was identified at time of analysis. Our independent assessment rates this as a real but low-priority issue, with an assessed vector of CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - adjacent-network access plus a cleartext deployment are both required, making successful exploitation contingent on deployment configuration.
Sensitive information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stems from the product's use of a hard-coded or predictable cryptographic key (CWE-321). Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5), an unauthenticated remote attacker who obtains that static key can read data the product intended to protect, with no integrity or availability impact. The real gate is acquiring or deriving the embedded key rather than defeating authentication: no public exploit identified at time of analysis, EPSS is only 0.26% (17th percentile), and CISA SSVC records exploitation as none with Automatable set to no, making this a moderate, not urgent, priority.
Hard-coded cryptographic keys and initialization vectors in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote authenticated attacker (CVSS 3.1 PR:L, 7.1 overall) to decrypt protected sensitive information and forge authentication tags, because the same static key material is baked into every deployment rather than generated per installation. Affected builds are the OpenShift-packaged FTM at 4.0.6.0 (including Interim Fixes 1 through 6) and, per ENISA EUVD, the 4.0.7.0 through 4.0.10.0 Interim Fix 06 range; the decisive prerequisite is compromise of a low-privilege account, and impact is primarily confidentiality with only partial integrity (C:H/I:L/A:N) and no availability loss. Exploitation is currently assessed as none - no public exploit code identified at time of analysis, EPSS only 0.22% (13th percentile), CISA SSVC exploitation "none", automatable "no" - which makes this a moderate-severity, lower-priority issue in practice.
Message forgery in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets remote, unauthenticated attackers send messages bearing forged cryptographic signatures that the platform improperly accepts as authentic, undermining the integrity of trusted transaction messaging (CWE-347, CVSS 7.5, integrity-only impact with no confidentiality or availability loss). Affected releases are the 4.0.6.0 line, including Interim Fixes 1 through 6, plus 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 06. Exploitation is remote and requires no authentication or user interaction (PR:N/UI:N) but demands that an attacker understand and correctly craft a message in FTM's expected format and that an FTM message interface be reachable; there is no public exploit identified at time of analysis (EPSS 0.19%, 9th percentile), CISA SSVC rates exploitation as none and automatable as no, and there is no KEV listing.
Remote code execution via ESQL command injection affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where externally supplied input is combined into ESQL statements without neutralization of special elements. Per IBM PSIRT scoring (CVSS 8.1, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), an unauthenticated remote attacker who can reach a vulnerable FTM message flow that builds ESQL commands from attacker-controlled data can achieve full confidentiality, integrity, and availability impact within the FTM runtime and its connected resources. The high attack-complexity rating reflects a non-default precondition - typically a specific flow or configuration that routes untrusted data into ESQL - so exposure is limited to environments running FTM on OpenShift with such a flow. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not provided.
Cleartext transmission of sensitive information in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift exposes transaction data, credentials, or other confidential payloads to anyone able to observe network traffic on the same segment. The issue affects deployments of FTM for OpenShift where the relevant transport is not wrapped in TLS; an unauthenticated attacker with an adjacent-network position (per the assessed vector PR:N, AV:A) can passively capture that traffic, though a successful capture depends on the specific unencrypted channel being in use (AC:H), which is why the independently assessed impact is limited to confidentiality only. No public exploit code has been identified at time of analysis, and there is no indication of active exploitation, so this remains a low-real-world-priority issue despite the headline 7.5 (High) CVSS score.
Improper restriction of XML external entity references in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an attacker positioned on an adjacent network segment - or elsewhere within the same cluster network - to read sensitive files and internal resources by submitting a crafted XML document to an FTM parsing endpoint. The assessed CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 7.4 High) confirms the exploitation requirements: no credentials and no user interaction are needed, but the adjacent-network prerequisite rather than an internet-facing vector meaningfully narrows the attacker population, and impact is confined strictly to confidentiality with no integrity or availability effect. There is no public exploit identified at time of analysis, no EPSS signal or CISA KEV listing is present in the provided data, and IBM has published a vendor advisory with a patch available for this CWE-611 flaw.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift fails to properly validate symbolic links, allowing an authenticated remote user to read files outside the intended path and disclose sensitive information held by the financial platform. The affected code path is reachable across the network (AV:N) but requires a valid FTM session (PR:L), and no public exploit code or confirmed active exploitation has been identified at time of analysis. IBM has published a vendor patch via its support portal; while the vendor-assigned CVSS of 9.9 implies a scope-changing, high-integrity and high-availability impact, independent analysis of the described weakness assesses it as an information-disclosure issue (file read) rather than full system compromise.
Unauthenticated remote code execution is possible in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift because the product improperly deserializes untrusted data (CWE-502), allowing a remote attacker who can reach a vulnerable endpoint to execute arbitrary code with the privileges of the affected service. IBM rates the flaw CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication, no user interaction and only network reachability are required, so any default-exposed FTM instance is at risk; the practical limiting factor is exposure, since FTM is specialized financial middleware normally deployed inside enterprise OpenShift clusters rather than on the public internet. Patch available per vendor advisory; no public exploit identified at time of analysis (no CISA KEV listing and no POC reporting in the available intelligence), though deserialization RCE is a well-understood and reliably weaponizable bug class once reachability exists.
Remote code execution in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated network attacker run arbitrary code on affected deployments. The flaw is CWE-94 (improper control of code generation): user-controlled input is passed into a JavaScript `new Function()` constructor without neutralization, so injected input is compiled and executed as code. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) no credentials, privileges, or victim interaction are required - only network reach to the vulnerable code path. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); the practical limiting factor is exposure, since the specific input-handling routine must be reachable and FTM's narrow financial-services enterprise footprint constrains the target population.
Denial of service in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift: unsafe reflection handling of externally controlled input lets an unauthenticated remote attacker (CVSS 3.1 AV:N/AC:L/PR:N/UI:N) drive the service into an availability failure, scored A:H with no confidentiality or integrity impact for a base score of 7.5. Deployments affected are the 4.0.6.x through 4.0.10.0 releases listed by IBM prior to the Interim Fix 064 level. Exploitation pressure currently looks low - EPSS is 0.60% (47th percentile), CISA's SSVC decision framework rates exploitation 'none' and automatable 'no', and no public exploit code has been identified at time of analysis - but the practical limiter is exposure rather than exploit difficulty, since this financial middleware is normally run inside controlled OpenShift clusters instead of the open internet.
Path traversal in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, affecting builds from 4.0.6.0 through 4.0.10.0 Interim Fix 06 (Operator 4.4.6+20260807.081800), allows an unauthenticated remote attacker (PR:N/UI:N per the CVSS vector) to submit manipulated path input that the product fails to canonicalize and thereby read arbitrary files accessible to the FTM process. The impact is confidentiality-only - no write, code execution, or availability effect - and exploitation requires network reachability to the FTM application endpoint, so internal-only routes or network segmentation materially reduce exposure. A vendor patch is available via IBM's advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low at 0.35% (28th percentile), making this a moderate rather than urgent priority.
Authenticated remote code execution affects IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, where a buffer overflow (out-of-bounds write) in an FTM component lets an attacker with valid low-privilege credentials submit crafted input and gain code execution in the containerized transaction platform. The vendor rates this 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), and our independent assessment concurs on high confidentiality and integrity impact while treating the scope change as unproven (S:U). Exploitation requires authentication (PR:L) and is not considered reliably repeatable on the first attempt (AC:H), and no public exploit identified at time of analysis. A vendor patch is available per IBM advisory node/7288641, so organizations running FTM on OpenShift should treat this as a priority patch action for their FTM estate.
Remote, unauthenticated attackers who can reach the application endpoints of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can perform unauthorized actions because the software fails to properly authenticate requests and subsequently omits authorization checks. Affected deployments are those running versions 4.0.6.0 through 4.0.10.0 Interim Fix 064, including Operator 4.4.6+20260807.081800 and the 4.0.6.0 Refresh build, per the EUVD version list. Impact is confined to integrity - attackers can trigger unauthorized operations or modify data, but there is no confidentiality or availability consequence per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), and there is no public exploit identified at time of analysis, with EPSS at only 0.60% (47th percentile) and CISA SSVC recording no observed exploitation.
Server-side request forgery (CWE-918) in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift at affected levels allows an authenticated local attacker to coerce the FTM server into issuing attacker-influenced requests, yielding disclosure of sensitive information and enabling unauthorized actions - rated CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), high confidentiality and integrity impact with no availability impact. Exploitation requires a deployed affected FTM instance plus valid low-privilege authenticated access reachable locally (the vector is local, not internet-facing, and user interaction is not required); no public exploit code has been identified at time of analysis and EPSS is 0.15% (5th percentile), while CISA SSVC records Exploitation: none and Automatable: no. This is a moderate-priority, not a drop-everything, issue: the niche financial middleware footprint, locally-scoped vector, and mandatory authentication mean an unauthenticated external attacker cannot exploit it directly against a default internet-facing posture. A vendor patch is available.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift contains a command execution flaw stemming from functionality being pulled in from an untrusted control sphere (CWE-829), so an attacker who already holds a low-privilege foothold in the OpenShift environment hosting the product can influence the untrusted source and cause arbitrary commands to run within the FTM process context. The attack is local (AV:L, PR:L, UI:N) - there is no unauthenticated or internet-facing path to the flaw - which limits exposure to environments that actually run the affected FTM build. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; the vendor has published a patch, and the vendor base score of 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a scope-change assumption that independent assessment does not confirm, so real-world severity should be treated as high-but-localized rather than remotely critical.
Privilege escalation in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a remote authenticated attacker who already holds a privileged account exceed the permissions assigned to that account, with high impact across confidentiality, integrity and availability. IBM rates it 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), a score driven mainly by the Scope-Change flag; our independent assessment preserves the full CIA impact but treats scope as unchanged, because the high starting-privilege requirement narrows the realistic attacker population to insiders or holders of compromised privileged credentials, and the deployment footprint is limited to organizations running FTM on OpenShift. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor patch advisory.
Hard-coded credentials embedded in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift let a local, low-privileged attacker - someone with at least an account, shell, pod, or container context in the deployment - reach a privileged FTM interface or data store and both read sensitive information and modify transaction data. Impacted releases include FTM for OpenShift 4.0.6.0 through the 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800), plus 4.0.7.0, 4.0.8.0, 4.0.9.0, and 4.0.10.0 Interim Fix 064. The issue is not remotely exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1), is not listed in CISA KEV, has no public exploit identified at time of analysis, and carries an EPSS of 0.14% (3rd percentile), keeping realistic risk moderate and largely confined to insiders or attackers who already hold a local foothold.
Local credential exposure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allows an already-authenticated, low-privilege local user to read insufficiently protected credentials and then use them to perform unauthorized actions against the environment, yielding high confidentiality and integrity impact with no availability impact. Only deployments running FTM for Red Hat OpenShift 4.0.6.0 through 4.0.10.0 (including the 0.6.0 Refresh build with Operator 4.4.6+20260807.081800 and 4.0.10.0 Interim Fix 064) are affected. Exploitation requires local access plus a valid low-privilege identity; no public exploit code has been identified at time of analysis (EPSS 0.14%, 4th percentile), and CISA SSVC records no known exploitation.
Deserialization of untrusted data in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets an unauthenticated attacker who already has network reachability to the affected component from an adjacent network segment execute arbitrary code with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). The exposure prerequisite is meaningful: the flaw is reachable from a neighboring position such as a compromised pod, sidecar or host inside the same OpenShift cluster or VLAN, not directly from the public internet, and no authentication or user interaction is required once that path is reachable. At the time of analysis there is no public exploit code identified and no evidence of confirmed active exploitation (no CISA KEV listing); IBM has published a vendor fix via its support advisory, so the primary risk window is the interval between advisory release and patch deployment.
Remote code execution in IBM FTM for Red Hat OpenShift is possible when an authenticated attacker submits a manipulated quantity value to a vulnerable feature, causing an out-of-bounds write (CWE-787) that can lead to arbitrary code execution. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw requiring low privileges and no user interaction, with full confidentiality, integrity, and availability impact. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis; a vendor patch is available via IBM support node 7288641.
IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can be driven into performing unauthorized actions by remote, unauthenticated attackers because its HTTP method-based security constraints do not cover every verb, allowing requests that fall outside the configured constraint set to reach protected functions. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) and CWE-306 assignment confirm a low-complexity, network-reachable missing-authentication defect with high confidentiality and integrity impact and no availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a patch advisory for the affected product line.
Cleartext transmission of sensitive or security-critical data by IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a network-positioned attacker read that traffic by passively sniffing the communication channel, resulting in high confidentiality loss without any integrity or availability impact. Affected deployments span the 4.0.6.0 release line (including the 4.0.6.0.0.6.0 Refresh, Operator 4.4.6+20260807.081800) through 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 064. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit code has been identified; EPSS is low at 0.20% (10th percentile), and CISA's SSVC assessment records exploitation: none, automatable: no. The practical barrier is the attacker's required vantage point on the traffic path, which our assessment reflects by treating attack complexity as high (AV:N/AC:H/PR:N/UI:N) rather than the vendor-published AC:L, making this a moderate rather than top-tier priority; a vendor patch is available.
Missing authorization checks in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift allow a remote, unauthenticated attacker to view and modify sensitive transaction data and to degrade or disrupt the service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation needs only network reachability to the FTM service with no credentials and no user interaction, which is why IBM rates it 9.8 - but real-world priority is tempered by a low EPSS score of 0.38% (32nd percentile), CISA SSVC 'Exploitation: none', and an SSVC 'partial' technical impact that suggests the achievable view/modify/DoS effect may be narrower than the full-impact CVSS rating implies. No public exploit code has been identified at time of analysis, and deployment exposure is the main gate: FTM for OpenShift is typically confined to segmented financial-institution networks rather than being internet-facing.
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even a low-privileged account read and modify resources outside their granted permissions, because the product's RBAC permission definitions rely on wildcards instead of explicit resource scoping. IBM scores this 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), while our independent assessment rates it 8.8 with Scope:Unchanged, meaning the practical severity is high but below the vendor's critical rating; exploitation still requires a valid account and a reachable Concert instance. No public exploit code has been identified at time of analysis and there is no evidence of active exploitation (not in CISA KEV), but IBM has published a vendor patch at support node 7288830.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker holding only low-level privileges to execute arbitrary operating-system commands on the affected deployment, giving full compromise of host confidentiality, integrity and availability (CVSS 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires a valid account and network reachability to the DataStage service, plus the ability to reach a parameter or job-input path whose value is passed into a shell command without neutralization; no user interaction is needed and complexity is rated low. At time of analysis no public exploit code and no confirmed active exploitation were identified, and IBM has published a vendor patch via its support advisory.
Authenticated remote code execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an attacker who holds a valid, low-privileged account to inject and execute arbitrary operating system commands through the product's command-handling logic, giving full compromise of confidentiality, integrity, and availability on the affected deployment. The flaw is rated CVSS v3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so it is network-reachable and requires no user interaction, but it is gated behind authentication - making stolen credentials or a malicious insider the realistic threat model rather than anonymous internet-wide exploitation. A vendor patch is available from IBM, and no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in the px-runtime component of IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated, low-privilege remote attacker to execute arbitrary operating system commands on the affected host, with full loss of confidentiality, integrity, and availability. Exploitation requires only valid credentials on the Cloud Pak for Data instance and network reachability to the vulnerable component (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8); it is not exploitable by unauthenticated users. No public exploit code has been identified at time of analysis, but IBM has published a vendor patch, and the low complexity of the flaw combined with high impact makes prompt upgrading advisable.
OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker with a low-privileged Cloud Pak for Data account execute arbitrary operating system commands on the affected node, resulting in full loss of confidentiality, integrity, and availability (C:H/I:H/A:H) with a CVSS 3.1 base score of 8.8. Exploitation is network-reachable and low-complexity with no user interaction (AV:N/AC:L/PR:L/UI:N), but it is gated behind a valid authenticated account that can reach the DataStage service, so exposure is limited to authenticated users of the 5.4.0.0 build. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; a vendor patch is available, so patched deployments are not exposed.
Authenticated OS command execution in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote attacker with a valid account plant special elements in a DataStage input path that are passed unsanitized into an operating-system command, resulting in arbitrary command execution with the privileges of the DataStage service. The prerequisite is a legitimate authenticated session (CVSS PR:L) on a network-reachable instance (AV:N/AC:L, UI:N), which limits realistic exposure to authorized users, compromised credentials, or malicious insiders on unpatched 5.4.0.0 deployments. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), but the vendor rates impact at 9.9 and a vendor patch is already available, so urgency is driven mainly by patch adoption rather than observed exploitation.
Authenticated SQL injection in IBM Guardium Data Protection 12.2 allows a high-privilege administrator to extract sensitive information from the appliance's underlying database by supplying malformed input to a specific application parameter that fails to neutralize SQL special elements. The attacker must already hold an authenticated management-console session with elevated privileges (CVSS PR:H), so exploitation is limited to trusted administrators or attackers who have already compromised admin credentials; no user interaction is required and the interface is network-reachable. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, making this a moderate-risk, targeted issue rather than a mass-exploitation candidate; a vendor patch is available.
Authorization bypass in IBM Guardium Data Protection 12.2 lets remote, unauthenticated network attackers (CVSS vector AV:N/PR:N/UI:N) reach the product's management/web interface and sidestep intended authorization checks, granting access to data-protection functions they should not be able to invoke. IBM scores the flaw 8.1 (HIGH) with full unscoped impact (C:H/I:H/A:H) and AC:H, while our independent assessment keeps the same unauthenticated network vector but lowers the assessed impact to C:L/I:L/A:L - meaning the practical effect is more likely unauthorized read/modification of limited functionality than complete compromise, with the high complexity reflecting a non-trivial precondition (a specific request state, timing, or authorization configuration) that the vendor does not disclose. No public exploit identified at time of analysis, and a vendor fix is available through IBM support node 7288035.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets a remote attacker who can reach the web management interface place script into an input that the application reflects into a generated page without output encoding, so JavaScript runs in the browser of any user who views that page. The vendor describes this as arbitrary code execution and scores it 8.1, but the weakness class is CWE-79 rather than a server-side code-execution primitive; our independent assessment rates it materially lower (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) because realistic exploitation needs a low-privileged foothold plus a victim with console access loading the crafted page, bounding impact to that user's session. No public exploit code was identified at time of analysis, and the issue is not listed in CISA KEV. Treat this as a high-CVSS-but-likely-overstated finding centered on console session abuse rather than host compromise.
Cross-site scripting in IBM Guardium Data Protection 12.2 lets an authenticated user with access to the management interface inject script that executes in the browser of another logged-in user who views the poisoned page, enabling session theft or actions performed with the victim's privileges. The vendor rates this CVSS 8.9 (High) with scope change, but the CWE-79 classification and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) identify it as an input-neutralization/XSS flaw rather than the remote code execution implied by some tagging; exploitation requires a valid account (PR:L, authenticated) plus victim interaction (UI:R) and does not work unauthenticated. No public exploit code and no CISA KEV listing were identified at time of analysis, and the vendor has published a patch advisory, so risk is real but constrained by the authentication and user-interaction prerequisites.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote, authenticated attacker holding only a low-privilege session to read sensitive information out of the product's backend database by supplying crafted input to a request parameter that is concatenated into a SQL command without neutralization. No user interaction is required and no public exploit code has been identified at time of analysis, so the practical risk depends on who can already reach the management interface - which is normally deployed on segmented internal networks, keeping broad internet-facing exposure low. Impact is confined to confidentiality (information disclosure); there is no integrity or availability effect, and only version 12.2 is named as affected.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows an authenticated, low-privileged user with existing access to the appliance host to raise their privileges to a higher level, affecting confidentiality, integrity and availability of the platform. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a pre-existing local account and low complexity but no user interaction; it is an escalation step rather than a remote entry vector, so risk is concentrated on collector/aggregator hosts where untrusted or lower-tier accounts or shells already exist. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied; this is a genuine but moderate-priority local privilege escalation rather than an actively exploited campaign.
Arbitrary code execution is possible on IBM Guardium Data Protection 12.2 when a remote attacker who already holds high-privilege credentials abuses a file-handling feature that fails to constrain a user-supplied pathname to its intended restricted directory (CWE-22). The requirement for HIGH privileges (PR:H) on the management interface is the primary limiting factor, restricting realistic exploitation to trusted administrative accounts on an appliance that is normally deployed on internal or segmented networks, though no user interaction is required (UI:N). The vendor has published a fix advisory, and no public exploit identified at time of analysis (no CISA KEV listing and no published proof-of-concept in the supplied intelligence).
OS command injection in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker to execute arbitrary operating system commands on the affected appliance, giving full compromise of confidentiality, integrity, and availability (CVSS 8.1, CWE-78). The assessed vector (AV:N/AC:H/PR:N/UI:N) means no credentials and no user interaction are needed, but exploitation is not a single deterministic request - the attacker must first satisfy a specific precondition such as a crafted payload meeting input constraints or a particular application/timing state, and the target's vulnerable network service must be reachable, which is uncommon for a security-monitoring appliance that is typically segmented. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available per the referenced IBM support advisory.
Cross-site request forgery in IBM Guardium Data Protection 12.2 lets a remote attacker with no credentials (CVSS vector PR:N) induce a currently authenticated user's browser into sending forged requests that bypass security restrictions and perform privileged actions in that user's context. Exploitation is not automatic: it requires the victim to be logged into the Guardium web interface (ideally as an administrator) and to be lured into loading attacker-controlled content while that session is live (UI:R), so it is best modeled as an attacker-assisted integrity abuse of an existing session rather than a self-contained compromise. IBM has acknowledged the flaw (CWE-352) and shipped a vendor fix, but no public exploit code has been identified at time of analysis and the issue does not appear on CISA KEV, so exploitation is not confirmed in the wild; successful attacks can alter configuration or security settings through the victim's own authorized privileges, but the attacker cannot read responses returned to that session.
Local privilege escalation in IBM Guardium Data Protection 12.2 allows a low-privileged local attacker to execute arbitrary commands as root by exploiting insufficient argument validation in the SUID-root nmap_wrapper binary on the Collector appliance, resulting in full compromise of the Collector. The vulnerability requires existing low-privileged local shell access to the Collector and is not remotely exploitable. No public exploit code or confirmed active exploitation has been identified at the time of analysis; a vendor patch is available.
Unauthenticated SQL injection in IBM Guardium Data Protection 12.2 lets a remote attacker submit crafted input that is concatenated into a SQL statement without proper neutralization, enabling execution of arbitrary SQL commands with full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). Per the assessed vector, no credentials and no user interaction are required, so any party who can reach the affected interface over the network can attempt exploitation; the practical barrier is deployment exposure, since Guardium management interfaces are normally placed on segmented internal or security-monitoring networks rather than being internet-facing. There is no public exploit code identified at time of analysis and the vulnerability is not listed in CISA KEV, but successful exploitation could allow reading or altering the data Guardium is entrusted to protect, which makes internal-network reachability the key risk factor. The specific injectable endpoint or parameter is not named in the available description, and if the flaw is second-order rather than first-order, real-world exploitation would require more steps than the AC:L rating implies. No EPSS score was supplied with the source data.
IBM Guardium Data Protection 12.2 accepts TLS peer certificates it should reject, letting an attacker positioned on the network path impersonate a trusted endpoint and bypass the security restrictions the encrypted channel is meant to enforce. The vector is PR:N and UI:N, so no credentials or user action are needed, but the practical barrier is the MITM foothold itself - ARP or DNS spoofing, a rogue access point, or a compromised intermediate segment - which is exactly why the score carries AC:H and why properly segmented deployments are largely shielded. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; IBM has published a vendor fix.
Missing authentication in the LoadBalancerServlet of IBM Guardium Data Protection 12.2 allows unauthenticated, network-reachable attackers to invoke privileged load-balancer operations, compromising the integrity and availability of the affected deployment. The flaw is rated 9.9 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and maps to CWE-306, so no credentials or user interaction are required; the practical barrier is that the Guardium management interface exposing the servlet must be reachable across the network, and such interfaces are usually confined to segmented internal networks. Impact is concentrated on load-balancer control operations rather than broad data exposure (confidentiality impact is low), and no public exploit identified at time of analysis; the issue is not listed in CISA KEV. IBM has published a patched release through its support advisory.
Cross-site request forgery in IBM Guardium Data Protection 12.2 allows a remote, unauthenticated attacker (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L, base 8.1) to bypass security restrictions by riding an already-authenticated administrator's browser session, producing high integrity impact on protected configuration. The attacker supplies no credentials of their own, but exploitation requires a victim who is currently logged in to Guardium to be tricked into loading attacker-controlled web content while that session is live, so no public exploit code has been identified at time of analysis. IBM has published a vendor patch via support page node 7288035, and deployments enforcing anti-CSRF tokens, SameSite cookies, or re-authentication for sensitive actions are materially less exposed.
IBM Guardium Data Protection 12.2 permits a remote authenticated attacker to bypass security restrictions through an improper authorization check, compromising integrity with limited confidentiality and availability impact. The flaw is network reachable at low complexity and requires a valid low-privilege session but no user interaction; no public exploit identified at time of analysis. Affected deployments should apply the vendor patch referenced in IBM support node 7288035.
Unauthenticated remote attackers can bypass security restrictions in IBM Guardium Data Protection 12.2 through the ChangeTrackerServlet, which is missing authentication (CWE-306). The vendor CVSS 3.1 vector rates this 9.9 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L), and the independent assessment preserves the unauthenticated network-reachable nature while treating scope as unchanged; no public exploit was identified at time of analysis and there is no CISA KEV confirmation. IBM has published patch information, so affected deployments should be updated and have network access to the management web tier restricted until patched.
Cross-site scripting in IBM Guardium Data Protection 12.2 allows an attacker holding valid low-privilege web interface credentials to inject content that executes scripts in a second, typically higher-privileged user's browser session when that user views the improperly neutralized page. Although the vendor description and the 'RCE' tag suggest arbitrary code execution, CWE-79 (improper neutralization of input during web page generation) and the assessed vector restrict impact to the victim's browser session in the web application's security context, not native code execution on the appliance, and exploitation requires both authenticated access and victim interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and IBM has published a patch advisory at https://www.ibm.com/support/pages/node/7288035.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote attacker who already holds a valid low-privilege session to execute arbitrary SQL commands against the appliance's backend database by supplying crafted input to a request parameter that is not properly neutralized before being used in a SQL statement. IBM rates this CVSS 9.1, driven by a high confidentiality impact on a platform whose core function is monitoring and protecting sensitive databases, though exploitation prerequisites are meaningful: the attacker must be authenticated (CVSS vector PR:L), needs network reach to the management interface, and only version 12.2 is named as affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, so risk is concentrated in environments where low-privilege credentials can be obtained or are broadly distributed, and a vendor patch is available.
OS command injection in IBM Guardium Data Protection 12.2 allows a privileged authenticated attacker to execute arbitrary commands with root-level privileges through the Universal Connector plugin upload feature. The flaw carries a CVSS 3.1 base score of 7.2 (HIGH) under the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, reflecting network reachability and full confidentiality, integrity and availability impact, though exploitation is gated behind a high-privilege account. No public exploit code is identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV).
Cross-site scripting (CWE-79) in IBM Guardium Data Protection 12.2 allows an authenticated remote user to supply crafted input to the web management console that is later rendered by a second, separate user's browser, executing attacker-controlled script in that victim's session. Exploitation requires two distinct conditions - a valid Guardium account to plant the payload and a privileged victim who loads the affected page - so it is not self-executing and cannot be triggered before authentication; despite the vendor description's reference to 'arbitrary code', the demonstrated impact is bounded to client-side script execution within the victim's browser session (session/token theft, forged UI actions, data exfiltration from the console), not server-side command execution. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and the vendor's 8.9 CVSS score overstates real-world risk relative to the assessed vector (PR:L/UI:R, confidentiality and integrity impact limited, no availability impact).
Improper authorization in IBM Guardium Data Protection 12.2 lets a remote attacker who already holds a valid low-privilege account reach functions or data that the platform's access controls are supposed to withhold, effectively bypassing security restrictions. The defect maps to CWE-285 (Improper Authorization); IBM rates it 7.4 while our independent assessment scores it 7.4-class only with scope unchanged, yielding a moderate 6.3-level risk because confidentiality, integrity, and availability impacts are all low. Authentication is required (CVSS vector PR:L), no user interaction is needed, and no public exploit code has been identified at time of analysis. A vendor patch is available via IBM support node 7288035, so remediation is straightforward for organizations that can schedule an upgrade.
SQL injection in IBM Guardium Data Protection 12.2 allows a remote authenticated attacker to execute arbitrary SQL commands against the appliance's back-end database, and the vendor rates it Critical (9.9) on a scope-changed vector while our independent assessment retains high impact on confidentiality, integrity, and availability on a scope-unchanged basis. Exploitation requires valid low-privilege credentials to the Guardium web/management console (CVSS PR:L) with no user interaction (UI:N), so a standard operator or auditor-level account is enough to reach the vulnerable query path, and Guardium is normally deployed on internal management networks rather than exposed to the internet, which meaningfully constrains realistic exposure. No public exploit code exists and there is no evidence of active exploitation at time of analysis (no CISA KEV listing), and a vendor patch is available.
Low-privileged authenticated users of IBM Guardium Data Protection 12.2 can extract hardcoded product master secrets embedded in the hardware_assess and obstore binaries, then use those secrets to reach the product's internal database and read sensitive system information. Exploitation is gated by an existing authenticated account on the appliance plus the ability to access the affected on-box binaries, so the realized attack surface is local/CLI-oriented rather than purely remote, and there is no public exploit identified at time of analysis. The vendor's 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates exposure for a hardcoded-credentials weakness; an independent assessment of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N is more consistent with a locally reachable, confidentiality-dominant issue that is brute-force gated by pre-existing authenticated access.