IBM
Monthly
Infosphere Information Server versions up to 11.7.1.6 is affected by improper restriction of xml external entity reference (CVSS 7.1).
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive information. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.6%.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenticated network attackers to execute arbitrary commands by sending malicious serialized Java objects exploiting the Apache Commons Collections InvokerTransformer class. This vulnerability is confirmed actively exploited in the wild per CISA KEV, with public exploit code available (Exploit-DB 41613) and an exceptionally high EPSS score of 93.49%, indicating near-certain exploitation probability. Affected products include Sterling B2B Integrator 5.2, Sterling Integrator 5.1, and Tivoli Common Reporting versions 2.1 through 3.1.2.1.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 21.0%.
Stack-based buffer overflow in IBM Forms Viewer 4.x before 4.0.0.3 and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary code via an XFDL form with a long fontname value. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 68.3%.
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to gain privileges via vectors involving (1) arp.ib or (2). Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow in the c1sizer ActiveX control in C1sizer.ocx in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execute arbitrary code via a long TabCaption string. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.2%.
Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.5%.
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.6%.
Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 61.9%.
Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a denial of service (daemon crash) or. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.0%.
Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.6%.
Stack-based buffer overflow in the RunAndUploadFile method in the Isig.isigCtl.1 ActiveX control in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allows remote attackers to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 68.4%.
Stack-based buffer overflow in pcspref.dll in pcsws.exe in IBM Personal Communications 5.9.x before 5.9.8 and 6.0.x before 6.0.4 might allow remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 75.1%.
An XPath injection flaw (CWE-643) in IBM Cloud Pak for Business Automation lets an authenticated user manipulate XPath queries and read data the query engine should never return, including sensitive application records and structural details of the underlying XML documents. All shipped 24.0.x, 25.0.0 and 26.0.0 streams are affected up to and including Interim Fix 001/005/008/009 respectively, and exploitation only requires a low-privileged, network-reachable session — no user interaction and no special complexity. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-on-schedule issue rather than an emergency.
Authenticated users of IBM ContextForge MCP Gateway through v1.0.4 can bypass the gateway's payload protection mechanisms because its recursive content inspection does not fully traverse deeply nested or embedded payload structures. Successful abuse yields limited but real integrity and confidentiality impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) by allowing disallowed content or instructions to pass through the filter that is meant to stop them, undermining the gateway's role as a security boundary between MCP clients and downstream tool servers. There is no public exploit code or CISA KEV entry at time of analysis, and IBM has published a fix via its support portal, so exposure is limited to unpatched deployments reachable by an authenticated account.
IBM Verify Identity Access containers may not apply management password change operations correctly.
IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services.
IBM Verify Identity Access is vulnerable to a buffer overflow attack.
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.
IBM Business Automation Workflow (both containerized and traditional deployments) fails to enforce authorization checks on certain import operations, letting an authenticated user invoke restricted import actions they should not be permitted to perform. Successful abuse yields limited confidentiality and integrity impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) rather than full system compromise. No public exploit code has been identified and the flaw is not listed in CISA KEV, but IBM has published a vendor patch, so unpatched deployments remain exposed to any user holding a valid low-privileged account.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to plant JavaScript inside Web UI content that is later rendered to other users. When a victim loads the affected page, the injected script runs inside the application's trusted origin, enabling session-token or credential theft and UI manipulation (CVSS 3.1 6.4, CWE-79). IBM has published a fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to persist arbitrary JavaScript inside Web UI content, which then executes in the browser of any other user who views the affected page. Successful exploitation can disclose session credentials or other sensitive data belonging to the victim's trusted session, and can alter the intended behavior of the Web UI for that user. IBM has published an advisory and states that a fix is available from the vendor; no public exploit code or CISA KEV listing was identified at time of analysis.
IBM Cloud Pak for Business Automation is affected by HTML injection (CWE-80) in one or more web UI components, allowing an attacker who already holds low-privileged authenticated access to inject markup that executes in a victim's browser within the hosting site's security context. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting a network-reachable, low-complexity flaw that still requires authentication and victim interaction, with scope change because the injected script runs against the site's origin. No EPSS score, CISA KEV entry, or public exploit code was provided in the intelligence feed, so active exploitation is unconfirmed; IBM has published a fix advisory.
XML External Entity (XXE) injection in IBM MQ's mqweb MFT REST API allows network-accessible, low-privileged attackers holding MFT publish authority to read sensitive files from the MQ server filesystem or cause denial of service. Affected deployments span seven release trains across LTS and CD channels from version 9.1 through 10.0.0.0. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is constrained by both authentication and a specific MFT publish privilege requirement.
Uncontrolled resource consumption in IBM Cloud Pak for Business Automation enables authenticated network users to exhaust service resources and trigger a denial of service condition. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, each capped at specific interim fix levels. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in IBM Cloud Pak for Business Automation allows authenticated remote users to invoke restricted API endpoints by supplying manipulated HTTP headers that the platform fails to adequately validate. Affected version lines include 24.0.0, 24.0.1, 25.0.0, and 26.0.0, each bounded by specific interim fix thresholds. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.
IBM Sterling B2B Integrator (6.2.0.0 through 6.2.0.6_2, 6.2.1.0-6.2.1.2, 6.2.2.0-6.2.2.1) and IBM Sterling File Gateway Standard Edition in the same version ranges contain an improper authentication flaw (CWE-287) that lets a remote authenticated attacker bypass security restrictions. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating a low-privilege authenticated network attacker can gain limited read and modify capability without user interaction, but no confidentiality-integrity-availability loss beyond partial. There is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the available intelligence, so this appears to be a targeted-patch issue rather than a mass-exploitation emergency.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
A time-of-check to time-of-use (TOCTOU) race condition in IBM i releases 7.3, 7.4, 7.5, and 7.6 lets a local attacker win a race window during a privileged file-ownership operation and end up owning arbitrary file system objects on the system. Successful exploitation yields low-level confidentiality, integrity, and availability impact but crosses a security boundary (CVSS scope change), meaning objects outside the attacker's own authority can be reassigned. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the CVSS base score is 6.0.
Authenticated command injection in IBM i Access Family releases 1.1.2.0 through 1.1.9.15 allows a logged-in user to run arbitrary operating-system commands under their own normal user privileges by supplying a session file whose contents are parsed without proper input validation. Because the injected commands execute only with the rights of the invoking account, the confidentiality, integrity and availability impact is limited rather than system-wide. No public exploit code or CISA KEV activity is identified at time of analysis, and no EPSS score was supplied with the input data.
IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.15 fail to properly validate user-supplied input in the emulator macro 'RunProgram' action, allowing an authenticated user to execute arbitrary operating-system commands with normal user privileges through a crafted macro. The flaw is a classic OS command injection (CWE-78) reachable over the network at low complexity, but it grants no privilege escalation beyond the invoking user's own rights, which is why IBM rates it 6.3 rather than critical. There is no public exploit code and no CISA KEV listing at time of analysis, so this is a hardening and lateral-movement concern rather than an urgent emergency patch item.
Improper input validation in the STRPCCMD CL command handling of IBM i Access Client Solutions (IBM i Access Family 1.1.2.0 through 1.1.9.15) lets an authenticated IBM i user inject and execute arbitrary operating-system commands on the machine running the ACS client, using only that user's normal privileges. IBM rated the issue CVSS 6.3 (AV:N/AC:L/PR:L/UI:N, low confidentiality/integrity/availability impact) and classifies it as OS command injection (CWE-78). There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed as active.
IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 enforce authorization for certain administrative user interface components only on the client side, so an attacker who already holds a valid low-privileged account can cause the browser to render admin-only UI elements that should have been hidden. The result is a limited information disclosure (CVSS 4.3, C:L, no integrity or availability impact) rather than full administrative takeover, and no public exploit code or CISA KEV entry was identified in the supplied intelligence. Because the flaw is a missing server-side authorization check (CWE-285), any authenticated user of the affected deployment can probe it trivially with low attack complexity.
Authenticated HTML injection in IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 lets a logged-in user plant unescaped markup in the management interface, so the product renders attacker-controlled content as trusted UI. The result is UI spoofing and phishing: a crafted page can impersonate legitimate Sterling Secure Proxy screens to harvest credentials or trick operators into unsafe actions, with limited confidentiality and integrity impact (CVSS 5.4). No public exploit code has been identified and the flaw is not listed in CISA KEV; the vendor has published a fix, though an exact fixed version is not named in the provided data.
Stored cross-site scripting in IBM Cognos Analytics 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 allows any authenticated non-privileged user to embed JavaScript in their own given name or surname profile fields. The payload is later rendered without encoding in the administrative user-account management panel, so the script executes in an administrator's browser session when that account's permissions are reviewed, potentially exposing the administrator's session cookies. The issue is rated CVSS 5.4 (medium) and a vendor patch is available; no public exploit code or CISA KEV entry was present in the provided intelligence, so active exploitation is not confirmed.
Improper cache key isolation in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an authenticated attacker to read and potentially manipulate another user's MCP (Model Context Protocol) server context by exploiting shared cache entries that are not scoped to individual user sessions. The MCP Tools component fails to include sufficient user-identity signals in cache keys, permitting cross-user context leakage. A vendor patch is available and no public exploit or KEV listing has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 enables unauthenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests. Exploiting this flaw, an attacker can probe internal network topology, reach cloud metadata endpoints (e.g., AWS IMDSv1), or use the server as a proxy to bypass network access controls. No public exploit code or CISA KEV listing has been identified at time of analysis, and IBM has released a patch via their support portal.
Server-side request forgery in IBM Langflow OSS versions 1.0.0 through 1.11.2 allows authenticated network attackers to induce the server to issue unauthorized HTTP requests to arbitrary destinations, enabling internal network enumeration or use of the server as a proxy to reach otherwise-isolated services. The vulnerability is classified as CWE-918 and is confirmed by IBM with a patch available at the vendor support page. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 permits unauthenticated remote attackers to cause the application server to issue arbitrary outbound HTTP requests. The primary risk is internal network enumeration - mapping services, ports, and hosts reachable from the Langflow deployment that are otherwise inaccessible to the external attacker - and potential use as a pivot to reach internal APIs or cloud metadata endpoints. No public exploit code exists and the CVE is not in the CISA KEV catalog; IBM has issued a patch via its support portal.
IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems.
Cross-site scripting (CWE-79) in IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, including the corresponding container editions, allows a remote unauthenticated attacker to run script in the browser of a logged-in user who follows a crafted link, potentially hijacking an authenticated session or performing actions as that user. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which reflects the need for victim interaction and the limited but scope-changing confidentiality and integrity impact typical of reflected XSS. There is no public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and the EPSS probability is only 0.20% (10th percentile), so this is a patching-hygiene issue rather than an emergency response item.
An open redirect flaw in IBM Verify Identity Access and Security Verify Access (including their container editions) lets a remote, unauthenticated attacker craft a link pointing at the product's own trusted domain that silently forwards the victim to an attacker-controlled site. Because the URL originates from the legitimate IBM identity provider, the redirect is highly convincing and can be used to harvest credentials or push further phishing stages. IBM has released fixes (Interim Fix 001 for the affected 10.0.0–10.0.9.2 and 11.0.0–11.0.3 streams); there is no public exploit identified at time of analysis, exploitation requires the victim to click a crafted link, and EPSS is very low at 0.19% (9th percentile).
HTTP request smuggling in IBM WebSphere Application Server 8.5 and 9.0 (including the Liberty variant) enables unauthenticated remote attackers to manipulate shared HTTP caches, circumvent web application firewall rules, and inject malicious scripts into responses served to other users. The root cause is improper parsing of the HTTP Transfer-Encoding request header (CWE-444), a class of vulnerability that exploits disagreement between a front-end proxy and the back-end application server over where one HTTP request ends and the next begins. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Open redirect (CWE-601) in IBM WebSphere Application Server 9.0, 8.5, and Liberty enables remote attackers to conduct phishing campaigns by crafting URLs hosted on the trusted WebSphere origin that silently forward victims to attacker-controlled sites. The vulnerability requires no authentication from the attacker but does depend on social engineering to lure victims into visiting the crafted URL. Successful exploitation allows credential harvesting, further targeted attacks, or brand abuse against organizations relying on WebSphere's trusted domain reputation. No public exploit or CISA KEV listing has been identified at time of analysis.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty allows remote unauthenticated attackers to poison web caches, bypass web application firewall protections, and conduct cross-site scripting attacks by sending specially crafted Transfer-Encoding headers. The root cause is CWE-444, inconsistent interpretation of HTTP request boundaries between WebSphere and a frontend proxy component. No public exploit or confirmed active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Blind server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables authenticated remote attackers to issue arbitrary internal HTTP requests by embedding malicious URLs within crafted SOAP messages processed by the server. Although the response is not directly returned to the attacker ('blind' SSRF), an adversary can exploit timing discrepancies and error differences to map internal network topology, probe cloud instance metadata endpoints (e.g., AWS IMDSv1), or reach services otherwise inaccessible from the public internet. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Reflected cross-site scripting in IBM WebSphere Application Server 8.5 and 9.0 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted link to the vulnerable server. Successful exploitation can lead to session token theft, credential harvesting, or unauthorized actions performed under the victim's browser context. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
An authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows an attacker on an adjacent network segment to reach and invoke an administrative console servlet without valid credentials, because the servlet is missing the authorization check that should gate it (CWE-862). Successful exploitation gives low-level confidentiality and integrity exposure plus a high availability impact on the affected server. IBM has released a vendor patch, and there is no CISA KEV listing, no publicly available exploit code, and no EPSS signal in the supplied data, so the practical risk is concentrated in environments where the admin console is reachable from an untrusted adjacent network.
Authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated attacker positioned on an adjacent network segment to reach request-handling functionality that performs no authorization check (CWE-862) and read sensitive information from the response. IBM has released a vendor patch, and there is no public exploit code or CISA KEV entry associated with this issue at time of analysis, so exploitation is not confirmed actively exploited. CVSS rates it 6.5 with confidentiality-only impact and PR:N/UI:N, but no EPSS score was supplied, leaving real-world exploitation likelihood unquantified.
IBM WebSphere Application Server 9.0 and 8.5 fail to neutralize CRLF and other control characters coming from remote input before writing them into the server's administrative log, letting an unauthenticated network attacker insert forged log entries (CWE-117, improper output neutralization for logs). The CVSS 3.1 score of 5.3 reflects low integrity impact only - confidentiality and availability are unaffected and no code execution is possible - but falsified administrative logs can mask real activity and mislead incident responders. IBM has published a fix (support page node 7286610); there is no CISA KEV listing and no public exploit identified at time of analysis, though CISA's SSVC assessment marks the issue as automatable.
Authorization bypass in IBM WebSphere Application Server 8.5 and 9.0 lets an attacker positioned on an adjacent network segment reach functionality without the required authorization checks, resulting in limited (low) confidentiality exposure with no integrity or availability impact. The published CVSS 3.1 score is only 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting that exploitation demands network adjacency and a high-complexity precondition rather than an internet-facing attack. There is no CISA KEV listing, no public exploit code identified in the provided sources, and an EPSS score was not supplied; IBM has published a fix. Note the tension between the 'authorization bypass' label and the very low scored impact — the advisory's own severity framing should be verified directly against the IBM support page.
Log injection in IBM WebSphere Application Server 8.5 and 9.0 lets a remote attacker forge entries in the server's administrative log, undermining the integrity of audit records used for monitoring and forensics. The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N) and stems from improper neutralization of log output (CWE-117). IBM has published a vendor fix, and no public exploit code or CISA KEV listing was identified at time of analysis.
An authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows remote attackers to reach protected resources without valid credentials when the XD or Intelligent-Management features are in use. Successful exploitation yields unauthorized access to confidential data (C:H) with no direct integrity or availability impact, consistent with the CWE-650 (trusting HTTP permission methods) classification. IBM has published an advisory and patch (node/7286610); no public exploit code or CISA KEV listing was present in the supplied intelligence, so active exploitation is unconfirmed.
Authenticated denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) lets a remote attacker with a valid database session crash the engine by triggering a null pointer dereference. The impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so confidentiality and integrity of stored data are not directly at risk, but any application or Db2 Connect client depending on the affected instance loses service. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, SSVC rates exploitation and automatable both as none/no, and no EPSS score was supplied in the intelligence feed.
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 accept forged requests without adequate validation, letting a remote attacker ride an authenticated administrator's browser session to read and lightly modify data exposed through the Db2 Mirror interface. Exploitation requires the victim to be logged in and to interact with attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4), so this is a cross-site request forgery rather than a pre-authentication takeover. There is no CISA KEV listing, no public exploit code identified, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no'; IBM has published a fix via its support advisory.
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) can be driven into a denial-of-service condition by a remote attacker who holds valid database credentials, through uncontrolled consumption of server resources. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so the impact is loss of availability only - no confidentiality or integrity exposure is claimed. Patch exists via IBM support document 7286983; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'.
An improper authentication flaw (CWE-287) in IBM Langflow OSS versions 1.0.0 through 1.10.2 lets a remote attacker who already holds a valid low-privileged account change the password of another user's account, resulting in account takeover rather than direct code execution. The CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), reflecting that exploitation requires an authenticated session and primarily damages integrity and availability of the targeted account. No public exploit code has been identified and the issue is not listed in CISA KEV, but SSVC flags partial technical impact and the vendor has published a fix; the exact patched version string is not enumerated in the available data.
IBM i Navigator for i — the browser-based administration console shipped with IBM i 7.3, 7.4, 7.5 and 7.6 — can be made to ignore the binding that ties an administrative session to the client's source IP address, allowing a remote, unauthenticated attacker (CVSS PR:N/UI:N) to reach sensitive information that should have been confined to a legitimate session. IBM scores the exposure 5.3 with confidentiality-only impact (C:L/I:N/A:N), consistent with a targeted information disclosure rather than a full compromise of the host. Vendor fixes are published, and no public exploit code or CISA KEV entry appears in the supplied intelligence, so this is best treated as a patch-on-schedule hardening item rather than an emergency.
Improper validation of the WebSocket origin in IBM i 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to read limited sensitive information by luring a logged-in user into a cross-origin WebSocket connection. The vulnerability requires user interaction (the victim must visit an attacker-controlled page) and yields only low confidentiality impact, giving a CVSS 3.1 base score of 4.3. There is no public exploit identified at time of analysis and CISA SSVC reports no active exploitation, so this is a low-urgency information-disclosure defect rather than an emergency patch item.
A race condition in the IBM i WebSocket handshake process allows a remote authenticated attacker to obtain sensitive information on IBM i 7.6, 7.5, 7.4, and 7.3. The flaw requires valid credentials and a precisely timed concurrent request pattern (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2), so it is a low-severity, non-automatable issue rather than a mass-exploitation candidate. CISA's SSVC assessment rates exploitation as 'none' with no automatable path, and no public exploit code has been identified at time of analysis; IBM has published a vendor patch.
Navigator for i - the web-based administration interface bundled with IBM i 7.3 through 7.6 - permits authenticated remote attackers to upload files to filesystem paths that Navigator's own configuration should prohibit, via a path traversal flaw (CWE-22). The bypass is bounded by the attacker's underlying IBM i profile permissions: Navigator's upload restrictions are circumvented, but the OS-level object authority of the user's profile still constrains what can actually be written. No public exploit exists and SSVC assesses exploitation status as none, placing this squarely in the medium-priority tier.
IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2 enforce input validation only on the client side, leaving the server-side API unprotected against modified requests. An attacker with local access can intercept or craft requests that bypass client-enforced restrictions, submitting values the application was not designed to accept, leading to unintended behavior - most critically characterized by IBM as high availability impact. No public exploit or active exploitation has been identified; SSVC classifies technical impact as partial with exploitation status as none.
In the Linux kernel, the following vulnerability has been resolved: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- <command>' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpu_cf_events at first event initialization. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands # echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online create an event for CPUs 0,2-X. Since the events are created with task-context, the scheduler will eventually schedule the program on CPU1. This CPU has not created and initialized any per CPU event infrastructure as that CPU was not online at the time of the perf invocation. Thus when the scheduler runs stress-ng on CPU1, the function cpumf_pmu_add() refers to a NULL pointer: struct cpu_cf_events *cpuhw = this_cpu_cfhw(); This function call is invoked after the task stress-ng has been made runnable on CPU1. And this_cpu_cfhw() returns NULL. The result is a panic: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000000000000 TEID: 0000000000000483 .... Krnl PSW : 0404d00180000000 000003ef8291fd0c (cpumf_pmu_add+0x3c/0x80) .... Call Trace: [<000003ef8291fd0c>] cpumf_pmu_add+0x3c/0x80 [<000003ef82bb5e3e>] event_sched_in+0xae/0x190 [<000003ef82bb60d6>] merge_sched_in+0x1b6/0x390 [<000003ef82bb65b8>] visit_groups_merge.constprop.0.isra.0+0x308/0x5b0 [<000003ef82bb689a>] pmu_groups_sched_in+0x3a/0x50 [<000003ef82bb6a30>] ctx_sched_in+0x180/0x260 [<000003ef82bb780c>] perf_event_context_sched_in+0x11c/0x2d0 [<000003ef82bb79ee>] __perf_event_task_sched_in+0x2e/0xc0 [<000003ef82994834>] finish_task_switch.isra.0+0x1a4/0x250 .... Last Breaking-Event-Address: [<000003ef8291f1d8>] this_cpu_cfhw+0x38/0x40 The issue arises only in per-task context when the CPUMF facility is used and the scheduler picks a random CPU for such a process to run on. The scheduler enables the CPUMF infrastructure via PMU callback functions pmu::add() and pmu::del(). Introduce a CPU hotplug prepare/dead callback pair which creates and removes the per CPU counter data while the CPU is offline. Count the users which track every CPU (cpu == -1), that is perf_event_open() events with task context and /dev/hwctr device sessions, in the new counter cpu_cf_root::tskcnt, protected by pmc_reserve_mutex. This ensures the infrastructure is available when new CPU is selected to run the per-task context process. In cpum_cf_free_root() and cpum_cf_free_cpu() ensure the reference pointer to data structures is set to NULL before the data is freed to prevent interrupt handlers to access stale data. [gor@linux.ibm.com: change commit message]
Server-Side Request Forgery (SSRF) in IBM Langflow OSS 1.0.0-1.11.5 allows remote authenticated attackers to make the server issue outbound HTTP requests to attacker-controlled or internal endpoints, leaking sensitive information from otherwise inaccessible systems. The scope-changed CVSS vector (S:C) confirms the vulnerability's reach extends beyond the Langflow application itself to adjacent internal infrastructure. IBM has released a patch and no public exploit code has been identified at time of analysis.
Arbitrary file read in IBM Langflow OSS 1.0.0 through 1.11.5 allows a remote authenticated attacker to access files outside their authorized scope due to improper access control (CWE-284). The CVSS vector confirms PR:L, meaning exploitation requires valid credentials but no elevated privileges, making this a post-authentication authorization flaw rather than an authentication bypass. No public exploit has been identified at time of analysis, and a vendor patch is available at IBM support node 7286657.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes an insecure direct object reference (CWE-639) in its runtime cache layer that permits an authenticated remote attacker to reference and manipulate cache objects they do not own, resulting in denial of service against data integration pipelines. The CVSS S:C (scope changed) metric signals that the impact crosses security boundaries beyond DataStage itself, potentially disrupting co-tenanted Cloud Pak for Data services. A vendor-supplied patch is available via IBM support page 7286562; no public exploit code has been identified at time of analysis.
Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read sensitive files outside the intended directory scope, potentially exposing credentials, configuration data, or other platform secrets. The CVSS vector assigns C:H/I:H/A:H, though IBM's own description limits the stated impact to information disclosure - an inconsistency worth verifying with the vendor advisory. No public exploit code or active exploitation has been identified at time of analysis.
Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-level privileges to traverse the file system beyond intended boundaries and read sensitive information from the underlying host or container. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation requiring only a valid low-privilege account with no user interaction. IBM has released a patch via their support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.
Authenticated path traversal in IBM Db2 11.5.x and 12.1.x allows a low-privileged database user to write arbitrary files to the underlying host filesystem via a specially crafted network request. The flaw (CWE-22) exploits insufficient pathname restriction in a Db2 request handler, enabling an attacker to place files outside intended directories - potentially overwriting configuration files, scripts, or other OS-level assets writable by the Db2 service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286985.
Server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables unauthenticated remote attackers to induce the server to issue arbitrary outbound HTTP requests, potentially reaching internal network resources not exposed externally. The vulnerability carries a CVSS 5.3 medium score, reflecting the constrained confidentiality impact (C:L) and absence of integrity or availability effects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though SSRF in enterprise middleware is a well-understood technique for internal network reconnaissance and cloud metadata exposure.
Cross-user file disclosure in IBM Langflow OSS 1.0.0-1.11.5 allows any authenticated low-privileged user to read files uploaded by other users by supplying arbitrary storage path identifiers in flow component inputs. The File/Read File component, when invoked via the /api/v1/run/advanced/{flow_id} endpoint, accepts user or flow storage namespace identifiers without verifying the requester owns the referenced namespace - a classic IDOR (CWE-639). No public exploit code has been identified at time of analysis, and IBM has released a patch.
Remote denial-of-service in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated network attacker to degrade service availability by sending a specially crafted request that triggers uncontrolled resource consumption (CWE-400). The CVSS A:L metric indicates partial rather than complete service disruption, limiting but not eliminating operational impact. IBM has released a patch via advisory 7286610; no public exploit code or active exploitation has been identified at time of analysis.
Log injection in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows unauthenticated remote actors to insert forged or malformed entries into application log files by supplying input containing special characters such as CRLF sequences that are written to logs without sanitization. The integrity impact is limited to log tampering - attackers cannot read data, escalate privileges, or disrupt service through this flaw alone, but forged log records can mislead incident responders and undermine audit-trail integrity. No public exploit has been identified at time of analysis, and IBM has released a patch via its support portal.
Infosphere Information Server versions up to 11.7.1.6 is affected by improper restriction of xml external entity reference (CVSS 7.1).
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive information. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.6%.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenticated network attackers to execute arbitrary commands by sending malicious serialized Java objects exploiting the Apache Commons Collections InvokerTransformer class. This vulnerability is confirmed actively exploited in the wild per CISA KEV, with public exploit code available (Exploit-DB 41613) and an exceptionally high EPSS score of 93.49%, indicating near-certain exploitation probability. Affected products include Sterling B2B Integrator 5.2, Sterling Integrator 5.1, and Tivoli Common Reporting versions 2.1 through 3.1.2.1.
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.7%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
IBM InfoSphere BigInsights before 2.1.0.3 allows remote authenticated users to bypass intended file and directory restrictions, or access untrusted data or code, via crafted parameters in unspecified. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 21.0%.
Stack-based buffer overflow in IBM Forms Viewer 4.x before 4.0.0.3 and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary code via an XFDL form with a long fontname value. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 68.3%.
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, allow local users to gain privileges via vectors involving (1) arp.ib or (2). Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Buffer overflow in the c1sizer ActiveX control in C1sizer.ocx in IBM SPSS SamplePower 3.0 before FP1 allows remote attackers to execute arbitrary code via a long TabCaption string. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.2%.
Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.5%.
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.6%.
Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 61.9%.
Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a denial of service (daemon crash) or. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 79.0%.
Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 66.6%.
Stack-based buffer overflow in the RunAndUploadFile method in the Isig.isigCtl.1 ActiveX control in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allows remote attackers to. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 68.4%.
Stack-based buffer overflow in pcspref.dll in pcsws.exe in IBM Personal Communications 5.9.x before 5.9.8 and 6.0.x before 6.0.4 might allow remote attackers to execute arbitrary code via a long. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 75.1%.
An XPath injection flaw (CWE-643) in IBM Cloud Pak for Business Automation lets an authenticated user manipulate XPath queries and read data the query engine should never return, including sensitive application records and structural details of the underlying XML documents. All shipped 24.0.x, 25.0.0 and 26.0.0 streams are affected up to and including Interim Fix 001/005/008/009 respectively, and exploitation only requires a low-privileged, network-reachable session — no user interaction and no special complexity. IBM has published a vendor fix; there is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-on-schedule issue rather than an emergency.
Authenticated users of IBM ContextForge MCP Gateway through v1.0.4 can bypass the gateway's payload protection mechanisms because its recursive content inspection does not fully traverse deeply nested or embedded payload structures. Successful abuse yields limited but real integrity and confidentiality impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) by allowing disallowed content or instructions to pass through the filter that is meant to stop them, undermining the gateway's role as a security boundary between MCP clients and downstream tool servers. There is no public exploit code or CISA KEV entry at time of analysis, and IBM has published a fix via its support portal, so exposure is limited to unpatched deployments reachable by an authenticated account.
IBM Verify Identity Access containers may not apply management password change operations correctly.
IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services.
IBM Verify Identity Access is vulnerable to a buffer overflow attack.
IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.
IBM Business Automation Workflow (both containerized and traditional deployments) fails to enforce authorization checks on certain import operations, letting an authenticated user invoke restricted import actions they should not be permitted to perform. Successful abuse yields limited confidentiality and integrity impact (CVSS 5.4, AV:N/AC:L/PR:L/UI:N) rather than full system compromise. No public exploit code has been identified and the flaw is not listed in CISA KEV, but IBM has published a vendor patch, so unpatched deployments remain exposed to any user holding a valid low-privileged account.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to plant JavaScript inside Web UI content that is later rendered to other users. When a victim loads the affected page, the injected script runs inside the application's trusted origin, enabling session-token or credential theft and UI manipulation (CVSS 3.1 6.4, CWE-79). IBM has published a fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
Stored cross-site scripting in IBM Cloud Pak for Business Automation allows an authenticated user to persist arbitrary JavaScript inside Web UI content, which then executes in the browser of any other user who views the affected page. Successful exploitation can disclose session credentials or other sensitive data belonging to the victim's trusted session, and can alter the intended behavior of the Web UI for that user. IBM has published an advisory and states that a fix is available from the vendor; no public exploit code or CISA KEV listing was identified at time of analysis.
IBM Cloud Pak for Business Automation is affected by HTML injection (CWE-80) in one or more web UI components, allowing an attacker who already holds low-privileged authenticated access to inject markup that executes in a victim's browser within the hosting site's security context. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), reflecting a network-reachable, low-complexity flaw that still requires authentication and victim interaction, with scope change because the injected script runs against the site's origin. No EPSS score, CISA KEV entry, or public exploit code was provided in the intelligence feed, so active exploitation is unconfirmed; IBM has published a fix advisory.
XML External Entity (XXE) injection in IBM MQ's mqweb MFT REST API allows network-accessible, low-privileged attackers holding MFT publish authority to read sensitive files from the MQ server filesystem or cause denial of service. Affected deployments span seven release trains across LTS and CD channels from version 9.1 through 10.0.0.0. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is constrained by both authentication and a specific MFT publish privilege requirement.
Uncontrolled resource consumption in IBM Cloud Pak for Business Automation enables authenticated network users to exhaust service resources and trigger a denial of service condition. Affected versions span the 24.0.0, 24.0.1, 25.0.0, and 26.0.0 release lines, each capped at specific interim fix levels. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Authorization bypass in IBM Cloud Pak for Business Automation allows authenticated remote users to invoke restricted API endpoints by supplying manipulated HTTP headers that the platform fails to adequately validate. Affected version lines include 24.0.0, 24.0.1, 25.0.0, and 26.0.0, each bounded by specific interim fix thresholds. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
An out-of-bounds write (buffer overflow) in the PASE AIX-runtime layer of IBM i 7.3, 7.4, 7.5, and 7.6 lets an authenticated local user crash their own PASE process, producing a self-limited denial of service. The independently assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) requires a valid IBM i account able to execute code in PASE, and per the vendor the impact is confined to terminating the attacker's own process rather than affecting other users, sessions, or the underlying operating system; the vendor's NVD entry scores it 5.2 under a scope-changed (S:C, I:L) interpretation. EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, so real-world risk is low and this should not be triaged as a critical memory-corruption event despite the buffer-overflow framing.
IBM Sterling B2B Integrator (6.2.0.0 through 6.2.0.6_2, 6.2.1.0-6.2.1.2, 6.2.2.0-6.2.2.1) and IBM Sterling File Gateway Standard Edition in the same version ranges contain an improper authentication flaw (CWE-287) that lets a remote authenticated attacker bypass security restrictions. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), indicating a low-privilege authenticated network attacker can gain limited read and modify capability without user interaction, but no confidentiality-integrity-availability loss beyond partial. There is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied in the available intelligence, so this appears to be a targeted-patch issue rather than a mass-exploitation emergency.
A buffer overflow in a PASE (Portable Application Solutions Environment) process on IBM i 7.3, 7.4, 7.5, and 7.6 allows an authenticated local user to crash the affected process. Per IBM's own description, the impact is limited: the attacker can terminate their own process rather than disrupt other users or system-wide services, which is reflected in the low CVSS 3.3 and Availability-only impact. There is no public exploit code and no CISA KEV listing at time of analysis, and the flaw is classified as CWE-125 (out-of-bounds read).
A time-of-check to time-of-use (TOCTOU) race condition in IBM i releases 7.3, 7.4, 7.5, and 7.6 lets a local attacker win a race window during a privileged file-ownership operation and end up owning arbitrary file system objects on the system. Successful exploitation yields low-level confidentiality, integrity, and availability impact but crosses a security boundary (CVSS scope change), meaning objects outside the attacker's own authority can be reassigned. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the CVSS base score is 6.0.
Authenticated command injection in IBM i Access Family releases 1.1.2.0 through 1.1.9.15 allows a logged-in user to run arbitrary operating-system commands under their own normal user privileges by supplying a session file whose contents are parsed without proper input validation. Because the injected commands execute only with the rights of the invoking account, the confidentiality, integrity and availability impact is limited rather than system-wide. No public exploit code or CISA KEV activity is identified at time of analysis, and no EPSS score was supplied with the input data.
IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.15 fail to properly validate user-supplied input in the emulator macro 'RunProgram' action, allowing an authenticated user to execute arbitrary operating-system commands with normal user privileges through a crafted macro. The flaw is a classic OS command injection (CWE-78) reachable over the network at low complexity, but it grants no privilege escalation beyond the invoking user's own rights, which is why IBM rates it 6.3 rather than critical. There is no public exploit code and no CISA KEV listing at time of analysis, so this is a hardening and lateral-movement concern rather than an urgent emergency patch item.
Improper input validation in the STRPCCMD CL command handling of IBM i Access Client Solutions (IBM i Access Family 1.1.2.0 through 1.1.9.15) lets an authenticated IBM i user inject and execute arbitrary operating-system commands on the machine running the ACS client, using only that user's normal privileges. IBM rated the issue CVSS 6.3 (AV:N/AC:L/PR:L/UI:N, low confidentiality/integrity/availability impact) and classifies it as OS command injection (CWE-78). There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed as active.
IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 enforce authorization for certain administrative user interface components only on the client side, so an attacker who already holds a valid low-privileged account can cause the browser to render admin-only UI elements that should have been hidden. The result is a limited information disclosure (CVSS 4.3, C:L, no integrity or availability impact) rather than full administrative takeover, and no public exploit code or CISA KEV entry was identified in the supplied intelligence. Because the flaw is a missing server-side authorization check (CWE-285), any authenticated user of the affected deployment can probe it trivially with low attack complexity.
Authenticated HTML injection in IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 lets a logged-in user plant unescaped markup in the management interface, so the product renders attacker-controlled content as trusted UI. The result is UI spoofing and phishing: a crafted page can impersonate legitimate Sterling Secure Proxy screens to harvest credentials or trick operators into unsafe actions, with limited confidentiality and integrity impact (CVSS 5.4). No public exploit code has been identified and the flaw is not listed in CISA KEV; the vendor has published a fix, though an exact fixed version is not named in the provided data.
Stored cross-site scripting in IBM Cognos Analytics 12.0.4 through 12.0.4 FP2 and 12.1.0 through 12.1.3 FP1 allows any authenticated non-privileged user to embed JavaScript in their own given name or surname profile fields. The payload is later rendered without encoding in the administrative user-account management panel, so the script executes in an administrator's browser session when that account's permissions are reviewed, potentially exposing the administrator's session cookies. The issue is rated CVSS 5.4 (medium) and a vendor patch is available; no public exploit code or CISA KEV entry was present in the provided intelligence, so active exploitation is not confirmed.
Improper cache key isolation in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an authenticated attacker to read and potentially manipulate another user's MCP (Model Context Protocol) server context by exploiting shared cache entries that are not scoped to individual user sessions. The MCP Tools component fails to include sufficient user-identity signals in cache keys, permitting cross-user context leakage. A vendor patch is available and no public exploit or KEV listing has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 enables unauthenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests. Exploiting this flaw, an attacker can probe internal network topology, reach cloud metadata endpoints (e.g., AWS IMDSv1), or use the server as a proxy to bypass network access controls. No public exploit code or CISA KEV listing has been identified at time of analysis, and IBM has released a patch via their support portal.
Server-side request forgery in IBM Langflow OSS versions 1.0.0 through 1.11.2 allows authenticated network attackers to induce the server to issue unauthorized HTTP requests to arbitrary destinations, enabling internal network enumeration or use of the server as a proxy to reach otherwise-isolated services. The vulnerability is classified as CWE-918 and is confirmed by IBM with a patch available at the vendor support page. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 permits unauthenticated remote attackers to cause the application server to issue arbitrary outbound HTTP requests. The primary risk is internal network enumeration - mapping services, ports, and hosts reachable from the Langflow deployment that are otherwise inaccessible to the external attacker - and potential use as a pivot to reach internal APIs or cloud metadata endpoints. No public exploit code exists and the CVE is not in the CISA KEV catalog; IBM has issued a patch via its support portal.
IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentially launch further attacks against the systems.
Cross-site scripting (CWE-79) in IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, including the corresponding container editions, allows a remote unauthenticated attacker to run script in the browser of a logged-in user who follows a crafted link, potentially hijacking an authenticated session or performing actions as that user. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), which reflects the need for victim interaction and the limited but scope-changing confidentiality and integrity impact typical of reflected XSS. There is no public exploit code identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and the EPSS probability is only 0.20% (10th percentile), so this is a patching-hygiene issue rather than an emergency response item.
An open redirect flaw in IBM Verify Identity Access and Security Verify Access (including their container editions) lets a remote, unauthenticated attacker craft a link pointing at the product's own trusted domain that silently forwards the victim to an attacker-controlled site. Because the URL originates from the legitimate IBM identity provider, the redirect is highly convincing and can be used to harvest credentials or push further phishing stages. IBM has released fixes (Interim Fix 001 for the affected 10.0.0–10.0.9.2 and 11.0.0–11.0.3 streams); there is no public exploit identified at time of analysis, exploitation requires the victim to click a crafted link, and EPSS is very low at 0.19% (9th percentile).
HTTP request smuggling in IBM WebSphere Application Server 8.5 and 9.0 (including the Liberty variant) enables unauthenticated remote attackers to manipulate shared HTTP caches, circumvent web application firewall rules, and inject malicious scripts into responses served to other users. The root cause is improper parsing of the HTTP Transfer-Encoding request header (CWE-444), a class of vulnerability that exploits disagreement between a front-end proxy and the back-end application server over where one HTTP request ends and the next begins. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available.
Open redirect (CWE-601) in IBM WebSphere Application Server 9.0, 8.5, and Liberty enables remote attackers to conduct phishing campaigns by crafting URLs hosted on the trusted WebSphere origin that silently forward victims to attacker-controlled sites. The vulnerability requires no authentication from the attacker but does depend on social engineering to lure victims into visiting the crafted URL. Successful exploitation allows credential harvesting, further targeted attacks, or brand abuse against organizations relying on WebSphere's trusted domain reputation. No public exploit or CISA KEV listing has been identified at time of analysis.
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty allows remote unauthenticated attackers to poison web caches, bypass web application firewall protections, and conduct cross-site scripting attacks by sending specially crafted Transfer-Encoding headers. The root cause is CWE-444, inconsistent interpretation of HTTP request boundaries between WebSphere and a frontend proxy component. No public exploit or confirmed active exploitation has been identified at time of analysis; a vendor patch is available from IBM.
Blind server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables authenticated remote attackers to issue arbitrary internal HTTP requests by embedding malicious URLs within crafted SOAP messages processed by the server. Although the response is not directly returned to the attacker ('blind' SSRF), an adversary can exploit timing discrepancies and error differences to map internal network topology, probe cloud instance metadata endpoints (e.g., AWS IMDSv1), or reach services otherwise inaccessible from the public internet. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Reflected cross-site scripting in IBM WebSphere Application Server 8.5 and 9.0 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted link to the vulnerable server. Successful exploitation can lead to session token theft, credential harvesting, or unauthorized actions performed under the victim's browser context. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available.
An authentication bypass in IBM WebSphere Application Server 9.0 and 8.5 allows an attacker on an adjacent network segment to reach and invoke an administrative console servlet without valid credentials, because the servlet is missing the authorization check that should gate it (CWE-862). Successful exploitation gives low-level confidentiality and integrity exposure plus a high availability impact on the affected server. IBM has released a vendor patch, and there is no CISA KEV listing, no publicly available exploit code, and no EPSS signal in the supplied data, so the practical risk is concentrated in environments where the admin console is reachable from an untrusted adjacent network.
Authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated attacker positioned on an adjacent network segment to reach request-handling functionality that performs no authorization check (CWE-862) and read sensitive information from the response. IBM has released a vendor patch, and there is no public exploit code or CISA KEV entry associated with this issue at time of analysis, so exploitation is not confirmed actively exploited. CVSS rates it 6.5 with confidentiality-only impact and PR:N/UI:N, but no EPSS score was supplied, leaving real-world exploitation likelihood unquantified.
IBM WebSphere Application Server 9.0 and 8.5 fail to neutralize CRLF and other control characters coming from remote input before writing them into the server's administrative log, letting an unauthenticated network attacker insert forged log entries (CWE-117, improper output neutralization for logs). The CVSS 3.1 score of 5.3 reflects low integrity impact only - confidentiality and availability are unaffected and no code execution is possible - but falsified administrative logs can mask real activity and mislead incident responders. IBM has published a fix (support page node 7286610); there is no CISA KEV listing and no public exploit identified at time of analysis, though CISA's SSVC assessment marks the issue as automatable.
Authorization bypass in IBM WebSphere Application Server 8.5 and 9.0 lets an attacker positioned on an adjacent network segment reach functionality without the required authorization checks, resulting in limited (low) confidentiality exposure with no integrity or availability impact. The published CVSS 3.1 score is only 3.1 (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), reflecting that exploitation demands network adjacency and a high-complexity precondition rather than an internet-facing attack. There is no CISA KEV listing, no public exploit code identified in the provided sources, and an EPSS score was not supplied; IBM has published a fix. Note the tension between the 'authorization bypass' label and the very low scored impact — the advisory's own severity framing should be verified directly against the IBM support page.
Log injection in IBM WebSphere Application Server 8.5 and 9.0 lets a remote attacker forge entries in the server's administrative log, undermining the integrity of audit records used for monitoring and forensics. The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N) and stems from improper neutralization of log output (CWE-117). IBM has published a vendor fix, and no public exploit code or CISA KEV listing was identified at time of analysis.
An authentication bypass in IBM WebSphere Application Server 8.5 and 9.0 allows remote attackers to reach protected resources without valid credentials when the XD or Intelligent-Management features are in use. Successful exploitation yields unauthorized access to confidential data (C:H) with no direct integrity or availability impact, consistent with the CWE-650 (trusting HTTP permission methods) classification. IBM has published an advisory and patch (node/7286610); no public exploit code or CISA KEV listing was present in the supplied intelligence, so active exploitation is unconfirmed.
Authenticated denial of service in IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) lets a remote attacker with a valid database session crash the engine by triggering a null pointer dereference. The impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so confidentiality and integrity of stored data are not directly at risk, but any application or Db2 Connect client depending on the affected instance loses service. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, SSVC rates exploitation and automatable both as none/no, and no EPSS score was supplied in the intelligence feed.
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 accept forged requests without adequate validation, letting a remote attacker ride an authenticated administrator's browser session to read and lightly modify data exposed through the Db2 Mirror interface. Exploitation requires the victim to be logged in and to interact with attacker-controlled content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N, base 5.4), so this is a cross-site request forgery rather than a pre-authentication takeover. There is no CISA KEV listing, no public exploit code identified, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no'; IBM has published a fix via its support advisory.
IBM Db2 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX and Windows (including Db2 Connect Server) can be driven into a denial-of-service condition by a remote attacker who holds valid database credentials, through uncontrolled consumption of server resources. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so the impact is loss of availability only - no confidentiality or integrity exposure is claimed. Patch exists via IBM support document 7286983; there is no public exploit identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'.
An improper authentication flaw (CWE-287) in IBM Langflow OSS versions 1.0.0 through 1.10.2 lets a remote attacker who already holds a valid low-privileged account change the password of another user's account, resulting in account takeover rather than direct code execution. The CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), reflecting that exploitation requires an authenticated session and primarily damages integrity and availability of the targeted account. No public exploit code has been identified and the issue is not listed in CISA KEV, but SSVC flags partial technical impact and the vendor has published a fix; the exact patched version string is not enumerated in the available data.
IBM i Navigator for i — the browser-based administration console shipped with IBM i 7.3, 7.4, 7.5 and 7.6 — can be made to ignore the binding that ties an administrative session to the client's source IP address, allowing a remote, unauthenticated attacker (CVSS PR:N/UI:N) to reach sensitive information that should have been confined to a legitimate session. IBM scores the exposure 5.3 with confidentiality-only impact (C:L/I:N/A:N), consistent with a targeted information disclosure rather than a full compromise of the host. Vendor fixes are published, and no public exploit code or CISA KEV entry appears in the supplied intelligence, so this is best treated as a patch-on-schedule hardening item rather than an emergency.
Improper validation of the WebSocket origin in IBM i 7.3, 7.4, 7.5, and 7.6 allows a remote attacker to read limited sensitive information by luring a logged-in user into a cross-origin WebSocket connection. The vulnerability requires user interaction (the victim must visit an attacker-controlled page) and yields only low confidentiality impact, giving a CVSS 3.1 base score of 4.3. There is no public exploit identified at time of analysis and CISA SSVC reports no active exploitation, so this is a low-urgency information-disclosure defect rather than an emergency patch item.
A race condition in the IBM i WebSocket handshake process allows a remote authenticated attacker to obtain sensitive information on IBM i 7.6, 7.5, 7.4, and 7.3. The flaw requires valid credentials and a precisely timed concurrent request pattern (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2), so it is a low-severity, non-automatable issue rather than a mass-exploitation candidate. CISA's SSVC assessment rates exploitation as 'none' with no automatable path, and no public exploit code has been identified at time of analysis; IBM has published a vendor patch.
Navigator for i - the web-based administration interface bundled with IBM i 7.3 through 7.6 - permits authenticated remote attackers to upload files to filesystem paths that Navigator's own configuration should prohibit, via a path traversal flaw (CWE-22). The bypass is bounded by the attacker's underlying IBM i profile permissions: Navigator's upload restrictions are circumvented, but the OS-level object authority of the user's profile still constrains what can actually be written. No public exploit exists and SSVC assesses exploitation status as none, placing this squarely in the medium-priority tier.
IBM Common Licensing Agent and ART versions 9.0 through 9.0.0.2 enforce input validation only on the client side, leaving the server-side API unprotected against modified requests. An attacker with local access can intercept or craft requests that bypass client-enforced restrictions, submitting values the application was not designed to accept, leading to unintended behavior - most critically characterized by IBM as high availability impact. No public exploit or active exploitation has been identified; SSVC classifies technical impact as partial with exploitation status as none.
In the Linux kernel, the following vulnerability has been resolved: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- <command>' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpu_cf_events at first event initialization. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands # echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online create an event for CPUs 0,2-X. Since the events are created with task-context, the scheduler will eventually schedule the program on CPU1. This CPU has not created and initialized any per CPU event infrastructure as that CPU was not online at the time of the perf invocation. Thus when the scheduler runs stress-ng on CPU1, the function cpumf_pmu_add() refers to a NULL pointer: struct cpu_cf_events *cpuhw = this_cpu_cfhw(); This function call is invoked after the task stress-ng has been made runnable on CPU1. And this_cpu_cfhw() returns NULL. The result is a panic: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000000000000 TEID: 0000000000000483 .... Krnl PSW : 0404d00180000000 000003ef8291fd0c (cpumf_pmu_add+0x3c/0x80) .... Call Trace: [<000003ef8291fd0c>] cpumf_pmu_add+0x3c/0x80 [<000003ef82bb5e3e>] event_sched_in+0xae/0x190 [<000003ef82bb60d6>] merge_sched_in+0x1b6/0x390 [<000003ef82bb65b8>] visit_groups_merge.constprop.0.isra.0+0x308/0x5b0 [<000003ef82bb689a>] pmu_groups_sched_in+0x3a/0x50 [<000003ef82bb6a30>] ctx_sched_in+0x180/0x260 [<000003ef82bb780c>] perf_event_context_sched_in+0x11c/0x2d0 [<000003ef82bb79ee>] __perf_event_task_sched_in+0x2e/0xc0 [<000003ef82994834>] finish_task_switch.isra.0+0x1a4/0x250 .... Last Breaking-Event-Address: [<000003ef8291f1d8>] this_cpu_cfhw+0x38/0x40 The issue arises only in per-task context when the CPUMF facility is used and the scheduler picks a random CPU for such a process to run on. The scheduler enables the CPUMF infrastructure via PMU callback functions pmu::add() and pmu::del(). Introduce a CPU hotplug prepare/dead callback pair which creates and removes the per CPU counter data while the CPU is offline. Count the users which track every CPU (cpu == -1), that is perf_event_open() events with task context and /dev/hwctr device sessions, in the new counter cpu_cf_root::tskcnt, protected by pmc_reserve_mutex. This ensures the infrastructure is available when new CPU is selected to run the per-task context process. In cpum_cf_free_root() and cpum_cf_free_cpu() ensure the reference pointer to data structures is set to NULL before the data is freed to prevent interrupt handlers to access stale data. [gor@linux.ibm.com: change commit message]
Server-Side Request Forgery (SSRF) in IBM Langflow OSS 1.0.0-1.11.5 allows remote authenticated attackers to make the server issue outbound HTTP requests to attacker-controlled or internal endpoints, leaking sensitive information from otherwise inaccessible systems. The scope-changed CVSS vector (S:C) confirms the vulnerability's reach extends beyond the Langflow application itself to adjacent internal infrastructure. IBM has released a patch and no public exploit code has been identified at time of analysis.
Arbitrary file read in IBM Langflow OSS 1.0.0 through 1.11.5 allows a remote authenticated attacker to access files outside their authorized scope due to improper access control (CWE-284). The CVSS vector confirms PR:L, meaning exploitation requires valid credentials but no elevated privileges, making this a post-authentication authorization flaw rather than an authentication bypass. No public exploit has been identified at time of analysis, and a vendor patch is available at IBM support node 7286657.
Improper authorization in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-privilege credentials to cause a high-impact denial of service, with scope change indicating the disruption extends beyond the DataStage component into the broader Cloud Pak for Data platform. The root cause (CWE-285) indicates the authorization layer fails to enforce adequate access controls on operations that can disrupt service continuity, meaning any authenticated user may invoke privileged destructive actions without detection. IBM has released a patch; no public exploit code has been identified at time of analysis.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes an insecure direct object reference (CWE-639) in its runtime cache layer that permits an authenticated remote attacker to reference and manipulate cache objects they do not own, resulting in denial of service against data integration pipelines. The CVSS S:C (scope changed) metric signals that the impact crosses security boundaries beyond DataStage itself, potentially disrupting co-tenanted Cloud Pak for Data services. A vendor-supplied patch is available via IBM support page 7286562; no public exploit code has been identified at time of analysis.
Absolute-path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to read sensitive files outside the intended directory scope, potentially exposing credentials, configuration data, or other platform secrets. The CVSS vector assigns C:H/I:H/A:H, though IBM's own description limits the stated impact to information disclosure - an inconsistency worth verifying with the vendor advisory. No public exploit code or active exploitation has been identified at time of analysis.
Absolute path traversal in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker with low-level privileges to traverse the file system beyond intended boundaries and read sensitive information from the underlying host or container. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates straightforward network exploitation requiring only a valid low-privilege account with no user interaction. IBM has released a patch via their support portal; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to disrupt service availability by exploiting a path traversal weakness (CWE-22). The affected component is the DataStage data-integration service running on IBM's Cloud Pak for Data platform. An authenticated user (PR:L) can supply crafted path input to reach files or resources outside intended directories, degrading or crashing the service; no public exploit has been identified at time of analysis, and the issue is not in CISA KEV.
Authenticated path traversal in IBM Db2 11.5.x and 12.1.x allows a low-privileged database user to write arbitrary files to the underlying host filesystem via a specially crafted network request. The flaw (CWE-22) exploits insufficient pathname restriction in a Db2 request handler, enabling an attacker to place files outside intended directories - potentially overwriting configuration files, scripts, or other OS-level assets writable by the Db2 service account. No public exploit code has been identified at time of analysis, and IBM has released a patch via advisory 7286985.
Server-side request forgery (SSRF) in IBM WebSphere Application Server 8.5 and 9.0 enables unauthenticated remote attackers to induce the server to issue arbitrary outbound HTTP requests, potentially reaching internal network resources not exposed externally. The vulnerability carries a CVSS 5.3 medium score, reflecting the constrained confidentiality impact (C:L) and absence of integrity or availability effects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though SSRF in enterprise middleware is a well-understood technique for internal network reconnaissance and cloud metadata exposure.
Cross-user file disclosure in IBM Langflow OSS 1.0.0-1.11.5 allows any authenticated low-privileged user to read files uploaded by other users by supplying arbitrary storage path identifiers in flow component inputs. The File/Read File component, when invoked via the /api/v1/run/advanced/{flow_id} endpoint, accepts user or flow storage namespace identifiers without verifying the requester owns the referenced namespace - a classic IDOR (CWE-639). No public exploit code has been identified at time of analysis, and IBM has released a patch.
Remote denial-of-service in IBM WebSphere Application Server 8.5 and 9.0 allows an unauthenticated network attacker to degrade service availability by sending a specially crafted request that triggers uncontrolled resource consumption (CWE-400). The CVSS A:L metric indicates partial rather than complete service disruption, limiting but not eliminating operational impact. IBM has released a patch via advisory 7286610; no public exploit code or active exploitation has been identified at time of analysis.
Log injection in IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 allows unauthenticated remote actors to insert forged or malformed entries into application log files by supplying input containing special characters such as CRLF sequences that are written to logs without sanitization. The integrity impact is limited to log tampering - attackers cannot read data, escalate privileges, or disrupt service through this flaw alone, but forged log records can mislead incident responders and undermine audit-trail integrity. No public exploit has been identified at time of analysis, and IBM has released a patch via its support portal.