IBM
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any IBM product.
RSS Feeds for IBM security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in IBM products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by IBM Sorted by Most Security Vulnerabilities since 2018
Known Exploited IBM Vulnerabilities
The following IBM vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| IBM Langflow Code Injection Vulnerability |
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. CVE-2026-9198 |
August 4, 2026 |
| IBM Aspera Faspex Code Execution Vulnerability |
IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw. CVE-2022-47986 Exploit Probability: 100.0% |
February 21, 2023 |
| IBM InfoSphere BigInsights Invalid Input Vulnerability |
Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data. CVE-2013-3993 Exploit Probability: 4.8% |
May 25, 2022 |
| IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. |
Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands CVE-2015-7450 Exploit Probability: 97.8% |
January 10, 2022 |
| IBM Data Risk Manager Arbritary File Download |
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to download arbitrary files from the system. IBM X-Force ID: 180535. CVE-2020-4430 Exploit Probability: 68.5% |
November 3, 2021 |
| IBM Data Risk Manager Authentication Bypass |
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system. IBM X-Force ID: 180532. CVE-2020-4427 Exploit Probability: 70.0% |
November 3, 2021 |
| IBM Data Risk Manager Command Injection |
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533. CVE-2020-4428 Exploit Probability: 61.7% |
November 3, 2021 |
| IBM Planning Analytics configuration overwrite vulnerability |
IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094. CVE-2019-4716 Exploit Probability: 86.4% |
November 3, 2021 |
Of the known exploited vulnerabilities above, 6 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.
By the Year
In 2026 there have been 1423 vulnerabilities in IBM with an average score of 7.1 out of ten. Last year, in 2025 IBM had 563 security vulnerabilities published. That is, 860 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.83.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 1423 | 7.09 |
| 2025 | 563 | 6.26 |
| 2024 | 503 | 6.44 |
| 2023 | 357 | 6.80 |
| 2022 | 327 | 6.36 |
| 2021 | 443 | 6.10 |
| 2020 | 353 | 6.19 |
| 2019 | 454 | 6.14 |
| 2018 | 451 | 6.24 |
It may take a day or so for new IBM vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent IBM Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-17068 | Oct 16, 2026 |
IBM i 7.3-7.6 NFS Version Restriction Bypass via Export Flag WeaknessIBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag. |
I
|
| CVE-2026-17073 | Oct 16, 2026 |
IBM i 7.3-7.6 Local Info Disclosure via Missing Tree Check in File HandleIBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution. |
I
|
| CVE-2026-17275 | Oct 16, 2026 |
IBM i 7.3-7.6 remote TA ID validation bypass allows unauthorized manipulationIBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers. |
I
|
| CVE-2026-17488 | Oct 16, 2026 |
IBM i 7.3-7.6 Improper Auth Bypass Security RestrictionsIBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. |
I
|
| CVE-2026-17491 | Oct 16, 2026 |
IBM i ChrootDirectory Bypass via Improper Enforcement (v7.3-7.6)IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive. |
I
|
| CVE-2026-93905 | Oct 13, 2026 |
IBM WebSphere Liberty 17.0.0.3-26.0.0.10 Unauth Remote Batch Status CorruptIBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances. |
Websphere Application Server Liberty
|
| CVE-2026-93909 | Oct 13, 2026 |
IBM WebSphere App Server Liberty 17.0.0.3-26.0.0.10 Auth Bypass via samlWeb-2.0IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enabled. |
Websphere Application Server Liberty
|
| CVE-2026-93895 | Oct 13, 2026 |
Unauthenticated gRPC Access Control Bypass in WAS Liberty 20.0.0.12-26.0.0.10IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. |
Websphere Application Server Liberty
|
| CVE-2026-95695 | Oct 13, 2026 |
IBM WebSphere Liberty 20.0.0.12-26.0.0.10 Auth Bypass via Incorrect AuthIBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization. |
Websphere Application Server Liberty
|
| CVE-2026-95696 | Oct 13, 2026 |
IBM WSAS Liberty 20.0.0.12-26.0.0.10 DDoS via Uncaught ExceptionIBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception. |
Websphere Application Server Liberty
|
| CVE-2026-11713 | Oct 13, 2026 |
IBM WAS Liberty 17.0.0.3-26.0.0.9 Privilege Escalation via restConnector-2.0IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled. |
Websphere Application Server Liberty
|
| CVE-2026-14532 | Oct 13, 2026 |
IBM WAS Liberty 17.0-26: Reader Role Exploits Version Info, Uncaught ExceptionIBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception. |
Websphere Application Server Liberty
|
| CVE-2026-14909 | Oct 13, 2026 |
IBM WAS Liberty 1726 Authenticated Info Disclosure via restConnector2.0IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled. |
Websphere Application Server Liberty
|
| CVE-2026-77816 | Oct 13, 2026 |
IBM WebSphere Liberty 17.0.0.3-26.0.0.9 Admin Client MITMIBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information. |
Websphere Application Server Liberty
|
| CVE-2026-79715 | Oct 13, 2026 |
IBM WebSphere AppSrv Liberty 17.0.0.3-26.0.0.9 Dir Traversal via Crafted ArchiveIBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory. |
Websphere Application Server Liberty
|
| CVE-2026-53711 | Oct 13, 2026 |
XSS in MCP Context Forge 0.2.00.3.1 Global Prompts unsanitized in Admin UIMCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts feature stores a prompt template without sufficient output encoding before the MCP Admin UI renders it. An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. The stored cross-site scripting can alter the interface, present phishing content, observe keystrokes available to the page, and act with the viewer's browser session. This issue is fixed in version 0.3.1. |
|
| CVE-2026-53709 | Oct 13, 2026 |
MCP Context Forge <1.0.2: Default JWT_KEY enables admin token forgingMCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECRET_KEY, while verify_jwt_token() accepts HS256 tokens signed with that key and get_current_user() creates a platform administrator when the token subject matches PLATFORM_ADMIN_EMAIL and REQUIRE_USER_IN_DB is false. A remote unauthenticated attacker can therefore mint accepted administrator tokens without a database account. While the vulnerable signing key remains configured and the platform-admin bootstrap remains enabled, forged access survives password rotation, account deletion, and session revocation, allowing administrative disclosure, modification, and service disruption. This issue is fixed in version 1.0.2. |
|
| CVE-2026-93907 | Oct 13, 2026 |
IBM WebSphere 8.5/9.0 Auth Bypass via CSIv2 Inbound PropagationIBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to bypass authentication by exploiting a flaw in the CSIv2 inbound propagation handler. |
WebSphere Application Server
|
| CVE-2026-95680 | Oct 13, 2026 |
IBM WAS 8.5/9.0 Auth Bypass -> Admin ImpersonationIBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impersonation across the cell. |
WebSphere Application Server
|
| CVE-2026-17484 | Oct 12, 2026 |
IBM i 7.3-7.6 Local DoS via Improper Access ControlIBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control. |
I
|
| CVE-2026-17487 | Oct 12, 2026 |
IBM i 7.3-7.6 Remote User Enumeration via Sign-On Error CodesIBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process. |
I
|
| CVE-2026-18318 | Oct 12, 2026 |
IBM i 7.3-7.6 Improper Auth Enables Brute-Force Credential TheftIBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication. |
I
|
| CVE-2026-18343 | Oct 12, 2026 |
IBM i 7.37.6 BOOTP Table Mod via Improper AuthIBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization. |
I
|
| CVE-2026-81858 | Oct 12, 2026 |
IBM i 7.37.6 File Server OOB Read Denial of ServiceIBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server. |
I
|
| CVE-2026-93886 | Oct 12, 2026 |
IBM i 7.3-7.6 Auth Script Exec via Improper Input ValidationIBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input. |
I
|
| CVE-2026-96119 | Oct 12, 2026 |
IBM i 7.3-7.6 HTTP Server Admin RCE via Improper Data SanitizationIBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application. |
I
|
| CVE-2026-75076 | Oct 12, 2026 |
IBM Aspera Enterprise WebApps 1.0.0-1.0.6 Source Map Info DisclosureIBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files. |
Aspera Enterprise Webapps
|
| CVE-2026-75095 | Oct 12, 2026 |
IBM Aspera WebApps 1.0.0-1.0.6 DoS via uncontrolled resource useIBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. |
Aspera Enterprise Webapps
|
| CVE-2026-75621 | Oct 12, 2026 |
IBM Aspera WebApps 1.0.0-1.0.6 Local Priv via Service Account PermissionsIBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account. |
Aspera Enterprise Webapps
|
| CVE-2026-75782 | Oct 12, 2026 |
IBM Aspera Enterprise WebApps 1.0.0-1.0.6 PATH ENV Local Priv EscIBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to gain elevated privileges due to a misconfigured PATH environment variable. |
Aspera Enterprise Webapps
|
| CVE-2026-92832 | Oct 12, 2026 |
IBM Aspera Enterprise WebApps 1.0.0-1.0.6: Local Attacker Can Read Sensitive DataIBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information. |
Aspera Enterprise Webapps
|
| CVE-2026-93891 | Oct 12, 2026 |
IBM TRIRIGA 5.0.0-5.0.8 XXE Injection Remote Info DisclosureIBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw. |
Tririga Application Platform
|
| CVE-2026-93892 | Oct 12, 2026 |
IBM TRIRIGA 5.0.0-5.0.8: Remote Auth Attacker Can Leak Session TokensIBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response. |
Tririga Application Platform
|
| CVE-2026-17475 | Oct 12, 2026 |
IBM Planning Analytics 2.0/2.1: Improper ACL Enables Deletion of User FoldersIBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control. |
Planning Analytics
|
| CVE-2026-18541 | Oct 12, 2026 |
IBM Planning Analytics 2.0/2.1 Stored XSS in Web UIIBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
Planning Analytics
|
| CVE-2026-19620 | Oct 12, 2026 |
IBM Planning Analytics 2.0/2.1 Improper Auth Remote Admin AccessIBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication. |
Planning Analytics
|
| CVE-2026-19622 | Oct 12, 2026 |
IBM Planning Analytics 2.0/2.1 Auth Bypass & Priv Esc via Sub-Req (CVE-2026-19622)IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests. |
Planning Analytics
|
| CVE-2026-75063 | Oct 12, 2026 |
IBM Planning Analytics 2.0/2.1 Authenticated XSS via Improper Output EncodingIBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding. |
Planning Analytics
|
| CVE-2026-75061 | Oct 12, 2026 |
IBM Planning Analytics 2.0 Directory Traversal via URL /../ (Remote File Write)IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system. |
Planning Analytics
|
| CVE-2026-19627 | Oct 12, 2026 |
IBM Planning Analytics 2.x RFI Path Traversal & File Overwrite VulnerabilityIBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths. |
Planning Analytics
|
| CVE-2026-85457 | Oct 12, 2026 |
IBM Planning Analytics 2.0/2.1 Remote Auth Code Exec via Stack OverflowIBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. |
Planning Analytics
|
| CVE-2026-82101 | Oct 12, 2026 |
IBM DataStage on Cloud Pak v5.4.0.0 Path Traversal Causing DoSIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability. |
Datastage On Cloud Pak Data
|
| CVE-2026-82103 | Oct 12, 2026 |
IBM DataStage on Cloud Pak for Data 5.4.0.0 Remote Authenticated Info DisclosureIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor. |
Datastage On Cloud Pak Data
|
| CVE-2026-82110 | Oct 12, 2026 |
IBM DataStage 5.4.0.0 Path Traversal Remote Code ExecutionIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal. |
Datastage On Cloud Pak Data
|
| CVE-2026-82096 | Oct 12, 2026 |
IBM DataStage 5.4.0.0 RCE via OS Command InjectionIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. |
Datastage On Cloud Pak Data
|
| CVE-2026-82108 | Oct 12, 2026 |
IBM DataStage 5.4.0.0 Remote Auth OS Command ExecIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. |
Datastage On Cloud Pak Data
|
| CVE-2026-84418 | Oct 12, 2026 |
IBM DataStage Cloud Pak 5.4 MITM TLS Cert Forge Captures IAM TokenIBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster. |
Datastage On Cloud Pak Data
|
| CVE-2026-90911 | Oct 12, 2026 |
IBM Maximo AI Service 9.1-9.2: Remote DoS via Uncontrolled Resource ConsumptionIBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. |
Maximo Ai Service
|
| CVE-2026-90912 | Oct 12, 2026 |
IBM Maximo AI SaaS 9.1-9.2 DoS via Uncontrolled RecursionIBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cause a denial of service due to uncontrolled recursion. |
Maximo Ai Service
|
| CVE-2026-90920 | Oct 12, 2026 |
IBM Maximo AI Service 9.1-9.2 RCE via Imp. Code GenIBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation. |
Maximo Ai Service
|