Ibm vulnerabilities

Published CVEs affecting Ibm products: 1618 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-10030 High · 7.1 CWE-285 Sep 18, 2026

IBM MQ Console is vulnerable to privilege escalation

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks.

CVE-2026-10027 Critical · 9.8 CWE-787 Sep 18, 2026

IBM MQ queue manager is vulnerable to unauthenticated remote code execution

IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow when processing malformed compressed data on channels configured with compression enabled.

CVE-2025-36178 Medium · 5.4 CWE-1284 Sep 18, 2026

Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.

CVE-2025-36147 Medium · 6.1 CWE-79 Sep 18, 2026

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2025-36421 Medium · 5.9 CWE-319 Sep 18, 2026

Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

CVE-2025-36076 Medium · 4.3 CWE-540 Sep 18, 2026

IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system.

CVE-2025-36045 Medium · 4.3 CWE-799 Sep 18, 2026

TS4300 Tape Library addresses security vulnerability

IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

CVE-2025-33147 Medium · 5.9 CWE-327 Sep 18, 2026

IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.

CVE-2025-33141 Medium · 6.5 CWE-497 Sep 18, 2026

IBM QRadar SIEM could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.

CVE-2025-15399 Critical · 10.0 CWE-352 Sep 18, 2026

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

CVE-2025-14754 High · 8.8 CWE-78 Sep 18, 2026

IBM Cloud Pak for Data is vulnerable to OS command injection

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.

CVE-2025-14753 High · 7.5 CWE-22 Sep 18, 2026

IBM Cloud Pak for Data is vulnerable to path traversal

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

CVE-2025-1350 Medium · 5.3 CWE-209 Sep 18, 2026

Multiple vulnerabilities in IBM Controller

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

CVE-2025-13882 Medium · 5.3 CWE-799 Sep 18, 2026

Multiple Security Vulnerabilities in IBM Sterling Partner Engagement Manager.

IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4.4 could allow an unauthenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

CVE-2024-56344 Medium · 5.9 CWE-327 Sep 18, 2026

IBM Cognos Analytics 12.0.4 and 12.1.3 versions are affected by security vulnerabilities

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

CVE-2026-12752 High · 7.1 CWE-611 Sep 15, 2026

Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource.

CVE-2026-12751 Medium · 5.4 CWE-80 Sep 15, 2026

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.

CVE-2026-12750 Medium · 5.4 CWE-79 Sep 15, 2026

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2026-12749 Medium · 5.4 CWE-79 Sep 15, 2026

Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

CVE-2026-12742 Medium · 5.4 CWE-862 Sep 15, 2026

Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026

IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authorization controls.

CVE-2026-12728 High · 8.8 CWE-502 Sep 15, 2026

IBM MQ Java messaging is vulnerable to remote code execution

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to execute arbitrary code due to a deserialization of untrusted data.

CVE-2026-12667 High · 7.1 CWE-611 Sep 15, 2026

IBM MQ .NET client is vulnerable to XML external entity injection

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an authenticated attacker to read files from a vulnerable .NET client or cause limited denial of service due to improper handling of XML external entities in RFH2 folder parsing.

CVE-2026-12666 High · 8.1 CWE-611 Sep 15, 2026

IBM MQ Java messaging is vulnerable to XML external entity injection

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 Classes for Java could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to XML external entity injection in MQRFH2 header processing.

CVE-2026-12358 High · 7.5 CWE-674 Sep 15, 2026

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources.

CVE-2026-12355 High · 8.1 CWE-74 Sep 15, 2026

IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution

IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 could allow an attacker to perform JNDI injection attacks due to insufficient input validation, potentially leading to information disclosure or remote code execution.