Ibm vulnerabilities

Published CVEs affecting Ibm products: 1629 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-81623 High · 8.8 CWE-78 Sep 18, 2026

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due to improper validation of user supplied input.

CVE-2026-80442 High · 8.8 CWE-78 Sep 18, 2026

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to an authenticated OS command injection vulnerability in the exportCertificate functionality. Successful exploitation could allow an attacker to execute unauthorized commands and impact the confidentiality, integrity, and availability of the affected system.

CVE-2026-80441 Critical · 9.8 CWE-89 Sep 18, 2026

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-order SQL injection vulnerability in the generateInsertQuery functionality of change-tracker-data.sql. A remote attacker could inject malicious SQL that is subsequently processed by the application, potentially resulting in compromise of the confidentiality, integrity, and availability of the affected system.

CVE-2026-75878 Critical · 9.1 CWE-287 Sep 18, 2026

IBM Sterling File Gateway is Vulnerable to Authentication Bypass

IBM Sterling File Gateway could allow a remote attacker to bypass authentication and obtain a fully authenticated session due to improper authentication via an unvalidated SSO header.

CVE-2026-18869 Medium · 6.4 CWE-918 Sep 18, 2026

IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands.

CVE-2026-17619 High · 8.6 CWE-89 Sep 18, 2026

The IBM Platform RTM is affected by an SQL injection vulnerability

IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

CVE-2026-17262 Medium · 5.4 CWE-78 Sep 18, 2026

IBM i is Affected By Denial of Service and Security Restriction Bypass Vulnerabilities in FTP [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands.

CVE-2026-11727 High · 8.1 CWE-122 Sep 18, 2026

IBM MQ for HPE NonStop is vulnerable to a denial of service issue

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data.

CVE-2026-11726 High · 8.1 CWE-125 Sep 18, 2026

IBM MQ for HPE NonStop is vulnerable to a denial of service issue

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values.

CVE-2026-11725 High · 8.8 CWE-190 Sep 18, 2026

IBM MQ queue manager is vulnerable to privilege escalation

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing.

CVE-2026-11722 Medium · 4.8 CWE-444 Sep 18, 2026

Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.

CVE-2026-11716 High · 7.5 CWE-122 Sep 18, 2026

IBM MQ for HPE NonStop is vulnerable to a denial of service attack

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data.

CVE-2026-11711 Medium · 6.5 CWE-502 Sep 18, 2026

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service component.

CVE-2026-11710 Medium · 6.5 CWE-444 Sep 18, 2026

IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers.

CVE-2026-11549 Medium · 6.5 CWE-284 Sep 18, 2026

Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a virtual host bypass vulnerability.

CVE-2026-11548 Medium · 4.8 CWE-444 Sep 18, 2026

Multiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by an HTTP request smuggling vulnerability.

CVE-2026-11545 Low · 3.7 CWE-862 Sep 18, 2026

IBM WebSphere Application Server is affected by a privilege escalation

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing authorization checks.

CVE-2026-11540 Medium · 5.3 CWE-863 Sep 18, 2026

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the file system through the FileTransfer servlet.

CVE-2026-11539 Medium · 5.3 CWE-306 Sep 18, 2026

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector.

CVE-2026-11538 Medium · 5.3 CWE-117 Sep 18, 2026

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies.

CVE-2026-1037 Medium · 6.1 CWE-79 Sep 18, 2026

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2026-1031 Medium · 6.1 CWE-79 Sep 18, 2026

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

CVE-2026-1030 Medium · 4.3 CWE-209 Sep 18, 2026

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive information about its environment, users, or associated data.

CVE-2026-1029 Medium · 5.4 CWE-79 Sep 18, 2026

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2026-1025 Medium · 6.1 CWE-79 Sep 18, 2026

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent