IBM
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any IBM product.
RSS Feeds for IBM security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in IBM products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by IBM Sorted by Most Security Vulnerabilities since 2018
Known Exploited IBM Vulnerabilities
The following IBM vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| IBM Langflow Code Injection Vulnerability |
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. CVE-2026-9198 |
August 4, 2026 |
| IBM Aspera Faspex Code Execution Vulnerability |
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. CVE-2022-47986 Exploit Probability: 100.0% |
February 21, 2023 |
| IBM InfoSphere BigInsights Invalid Input Vulnerability |
Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data. CVE-2013-3993 Exploit Probability: 4.8% |
May 25, 2022 |
| IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. |
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands CVE-2015-7450 Exploit Probability: 97.8% |
January 10, 2022 |
| IBM Data Risk Manager Arbritary File Download |
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535. CVE-2020-4430 Exploit Probability: 68.5% |
November 3, 2021 |
| IBM Data Risk Manager Authentication Bypass |
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532. CVE-2020-4427 Exploit Probability: 70.0% |
November 3, 2021 |
| IBM Data Risk Manager Command Injection |
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533. CVE-2020-4428 Exploit Probability: 61.7% |
November 3, 2021 |
| IBM Planning Analytics configuration overwrite vulnerability |
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094. CVE-2019-4716 Exploit Probability: 86.4% |
November 3, 2021 |
Of the known exploited vulnerabilities above, 6 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.
By the Year
In 2026 there have been 1468 vulnerabilities in IBM with an average score of 7.1 out of ten. Last year, in 2025 IBM had 563 security vulnerabilities published. That is, 905 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.81.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1468 | 7.06 |
| 2025 | 563 | 6.26 |
| 2024 | 503 | 6.44 |
| 2023 | 357 | 6.80 |
| 2022 | 327 | 6.36 |
| 2021 | 443 | 6.10 |
| 2020 | 353 | 6.19 |
| 2019 | 454 | 6.14 |
| 2018 | 451 | 6.24 |
It may take a day or so for new IBM vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent IBM Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-76587 | Oct 20, 2026 |
Stack-based Buffer Overflow in IBM Planning Analytics 2.0/2.1IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system. |
Planning Analytics
|
| CVE-2026-9825 | Oct 20, 2026 |
IBM Cyber Fraud 1.0.0-1.0.2 Missing Secure Cookie Attribute Exposes Session DataIBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks. |
Cyber Fraud
|
| CVE-2026-81212 | Oct 20, 2026 |
IBM DataStage CP4D 5.4.0.0: Unauth Write to Shared Redis (Tenant Cache)IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters. |
Datastage On Cloud Pak Data
|
| CVE-2026-82891 | Oct 20, 2026 |
IBM Guardium DP 12.x Hardcoded Crypto Key Remote Info DisclosureIBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key. |
Guardium Data Protection
|
| CVE-2026-87800 | Oct 20, 2026 |
IBM Cyber Fraud 1.0.0-1.0.2 Remote Authenticated Code Exec via Unsafe File UploadIBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type. |
Cyber Fraud
|
| CVE-2026-92559 | Oct 20, 2026 |
IBM App Connect Enterprise v13.0.1-13.0.8.2 Unrestricted IP Binding RCEIBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address. |
App Connect Enterprise
|
| CVE-2026-93441 | Oct 20, 2026 |
Denial of Service via Uncontrolled Resource Consumption in IBM QRadar SIEMIBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. |
Qradar Security Information Event Management
|
| CVE-2026-93442 | Oct 20, 2026 |
IBM QRadar SIEM 7.57.6.4 OOB Read Enables DoS & Info LeakIBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read. |
Qradar Security Information Event Manager
|
| CVE-2026-93744 | Oct 20, 2026 |
IBM i Navigator Improper Access Control 7.3-7.6IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to authentication, a bad actor could exploit this vulnerability to alter server-side session security state. |
I
|
| CVE-2026-93888 | Oct 20, 2026 |
IBM Sterling Connect Direct for Unix 6.3-6.4 Code Injection in apnotifyIBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input. |
Sterling Connect Direct
|
| CVE-2026-94402 | Oct 20, 2026 |
IBM Carbon Charts 0.4.01.27.19 MeterChart XSS via Title.truncateTitleIBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session. |
Carbon Charts
Carboncharts React
Carboncharts Angular
And others... |
| CVE-2026-8355 | Oct 19, 2026 |
IBM ContextForge MCP Gateway 0.1.0-1.0.5 SSRF via OAuth token_urlIBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST requests to internal network resources and cloud metadata endpoints. The vulnerability occurs during OAuth-enabled gateway registration when the system fails to validate the oauth_config.token_url parameter. When registering a gateway with OAuth client credentials authentication, an attacker can supply a malicious token_url pointing to internal services, cloud metadata endpoints (AWS IMDSv1, GCP, Azure), or localhost-bound services. The application immediately performs an HTTP POST request to the attacker-controlled URL with form-encoded credentials in the body. If the response cannot be parsed as a valid OAuth token response, up to 256 characters of the response body are reflected back to the attacker in the HTTP 502 error message. This vulnerability bypasses existing SSRF protections that are applied to the gateway.url field but not to OAuth configuration parameters. |
Contextforge Mcp Gateway
|
| CVE-2025-36061 | Oct 19, 2026 |
Denial of Service via SMTP in IBM Storage TS4500 Lib 1.1.1.61.12.0.3IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume excessive amounts of system resources. |
Storage Ts4500 Library
|
| CVE-2025-36069 | Oct 19, 2026 |
IBM TS4500 Library 1.1.1.6-1.12.0.3 Session Invalidation Allows ImpersonationIBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system. |
Storage Ts4500 Library
|
| CVE-2025-36252 | Oct 19, 2026 |
IBM TS4500 Tape Lib 1.1.1.6-1.12.0.3 Session Invalidation BypassIBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system. |
Storage Ts4500 Library
|
| CVE-2026-19178 | Oct 19, 2026 |
IBM Storage TS4500 Library 1.1.1.6-1.12.0.3 Race Condition Remote Auth Priv EscIBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition. |
Storage Ts4500 Library
|
| CVE-2023-38375 | Oct 19, 2026 |
IBM Cloud Pak System 2.3.6.01 XSS in Web UIIBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
Cloud Pak System
|
| CVE-2026-3161 | Oct 19, 2026 |
IBM Cloud Pak System 2.3.6.0/1 Weak Crypto Decrypt Sensitive DataIBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
Cloud Pak System
|
| CVE-2026-3295 | Oct 19, 2026 |
IBM Cloud Pak System 2.3.6.x Stored XSS via Unsanitized User InputIBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app usersupplied input is not properly sanitized or HTMLencoded before being stored and rendered. An authenticated attacker could exploit this vulnerability by entering specially crafted payloads containing malicious JavaScript which are saved within the app and later executed automatically when user views affected pages, resulting in Stored CrossSite Scripting (Stored XSS). |
Cloud Pak System
|
| CVE-2026-4418 | Oct 19, 2026 |
IBM Cloud Pak Sys 2.3.6.0 HTML Injection (remote auth)IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. |
Cloud Pak System
|
| CVE-2026-1501 | Oct 19, 2026 |
IBM Concert 1.0-3.0 Improper Cert ValidationIBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation. |
Concert
|
| CVE-2026-1510 | Oct 19, 2026 |
IBM Concert 1.0-3.0.0 Info Disclosure via Heap InspectionIBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection. |
Concert
|
| CVE-2026-3303 | Oct 19, 2026 |
IBM Concert 1.0-3.0.0 CORS Misconfiguration Enables Privileged ActionsIBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain name is not being limited to only trusted domains. |
Concert
|
| CVE-2026-3628 | Oct 19, 2026 |
IBM Concert < 3.0.0 Info Disclosure via Schema SuggestionsIBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions. |
Concert
|
| CVE-2026-4405 | Oct 19, 2026 |
IBM Concert 1.0-3.0.0 Local Cache Leakage to Other UsersIBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system. |
Concert
|
| CVE-2026-4413 | Oct 19, 2026 |
IBM Concert 1.0-3.0.0 XSS: Unauth Web UI JS InjectionIBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
Concert
|
| CVE-2026-6719 | Oct 19, 2026 |
IBM Concert 1.0-3.0 Weak Crypto Enables DecryptIBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
Concert
|
| CVE-2026-6930 | Oct 19, 2026 |
IBM Concert Weak Crypto before 3.0.0 Decrypt Sensitive DataIBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
Concert
|
| CVE-2026-15661 | Oct 19, 2026 |
Log Injection in IBM Concert 1.0-3.0.0 Log MessagesIBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files. |
Concert
|
| CVE-2026-14511 | Oct 19, 2026 |
IBM MQ 9.4.5.0-9.4.5.1 Authenticated DoS via Crafted MessageIBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications. |
Mq
|
| CVE-2026-10572 | Oct 19, 2026 |
IBM MQ Heap Overflow via MQPUT may allow DoS or code executionIBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-10574 | Oct 19, 2026 |
IBM MQ Heap Buffer Overflow in MQPUT1 Leading to Arbitrary Code ExecutionIBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-10743 | Oct 19, 2026 |
IBM MQ Authenticated Attacker Can Cause DoS via MQOPEN Buffer Size ValidationIBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-11828 | Oct 19, 2026 |
IBM MQ: Improper Queue Name Length Validation Client DSIBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-11829 | Oct 19, 2026 |
IBM MQ DoS via Improper Offset Validation in MQOPENIBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-11831 | Oct 19, 2026 |
IBM MQ: Authenticated Bof Causes DoS & Info Leak via OOB Read in Client RequestIBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-12148 | Oct 19, 2026 |
IBM MQ Operator Unrestricted Java Deserialization (CVE-2026-12148)IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-12155 | Oct 19, 2026 |
IBM MQ Authenticated DoS via NULL Pointer Deref in Multicast MessagesIBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-12343 | Oct 19, 2026 |
IBM MQ RFH2 Header Validation DoS in Queued Pub/SubIBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-12350 | Oct 19, 2026 |
IBM MQ Authenticated DoS via Crafted Async Consume RequestIBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-12660 | Oct 19, 2026 |
IBM MQ Web Console Authenticated Admin File Write via Path Validation FlawIBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-12665 | Oct 19, 2026 |
IBM MQ TLS DN Stack Buffer Overflow Enables Remote Code ExecIBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-12669 | Oct 19, 2026 |
IBM MQ OOB Read via Malformed Compressed Data (CVE-2026-12669)IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-12727 | Oct 19, 2026 |
IBM MQ Off-by-One Buffer Overflow Allows Authenticated Process InstabilityIBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-12670 | Oct 19, 2026 |
IBM MQ Authenticated DoS via Excessive Memory Ops in Charset ConversionIBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion. |
Mq Operator
Mq Advanced Container Images
|
| CVE-2026-17068 | Oct 16, 2026 |
IBM i 7.3-7.6 NFS Version Restriction Bypass via Export Flag WeaknessIBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag. |
I
|
| CVE-2026-17073 | Oct 16, 2026 |
IBM i 7.3-7.6 Local Info Disclosure via Missing Tree Check in File HandleIBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution. |
I
|
| CVE-2026-17275 | Oct 16, 2026 |
IBM i 7.3-7.6 remote TA ID validation bypass allows unauthorized manipulationIBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers. |
I
|
| CVE-2026-17488 | Oct 16, 2026 |
IBM i 7.3-7.6 Improper Auth Bypass Security RestrictionsIBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. |
I
|
| CVE-2026-17491 | Oct 16, 2026 |
IBM i ChrootDirectory Bypass via Improper Enforcement (v7.3-7.6)IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive. |
I
|