ibm vulnerabilities

Recent CVEs affecting ibm products. 127 tracked.

ibm has 127 tracked vulnerabilities, 15 critical. A fixed release or vendor patch exists for 107. Most recent: 2026-10-19. Highest priority: CVE-2026-14512 (score 58/100).

CVE-2026-14512 CRITICAL 9.8 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deseriali
CVE-2026-14446 CRITICAL 9.8 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in t
CVE-2026-14959 CRITICAL 9.1 UPGRADE IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary co
CVE-2026-14958 CRITICAL 9.1 UPGRADE IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary co
CVE-2026-14974 HIGH 8.1 UPGRADE IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary c
CVE-2026-14973 CRITICAL 9.3 UPGRADE IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of th
CVE-2026-15280 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a
CVE-2026-15057 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due
CVE-2026-16184 HIGH 7.0 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sendin
CVE-2026-14528 HIGH 7.4 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive in
CVE-2026-14996 HIGH 8.2 UPGRADE IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.
CVE-2026-13463 HIGH 7.5 DOWNGRADE IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion
CVE-2026-14976 HIGH 7.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with
CVE-2026-16192 HIGH 7.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulner
CVE-2026-14515 MEDIUM 6.1 UPGRADE IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-sit
CVE-2026-4932 MEDIUM 4.2 UPGRADE UPGRADE IBM PowerVM Hypervisor FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 could allow an attacker wi
CVE-2026-12118 CRITICAL 9.8 DOWNGRADE IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute ar
CVE-2026-15435 CRITICAL 9.8 UPGRADE IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote att
CVE-2026-14522 HIGH 8.8 UPGRADE IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote att
CVE-2026-14519 HIGH 7.5 UPGRADE IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote att
CVE-2026-11897 HIGH 7.5 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, cau
CVE-2026-11536 HIGH 8.5 UPGRADE IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP
CVE-2026-11707 CRITICAL 9.3 UPGRADE UPGRADE IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cro
CVE-2026-12947 HIGH 7.5 UPGRADE IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensi
CVE-2026-14980 HIGH 8.3 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forge
CVE-2026-10545 HIGH 7.5 UPGRADE IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to
CVE-2026-10535 HIGH 8.4 UPGRADE IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2
CVE-2026-11885 HIGH 8.4 UPGRADE UPGRADE IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H1
CVE-2026-11980 HIGH 7.3 UPGRADE IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-u
CVE-2026-11383 MEDIUM 5.4 UPGRADE UPGRADE IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross
CVE-2026-10695 MEDIUM 6.2 UPGRADE IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced fe
CVE-2026-10569 MEDIUM 4.3 UPGRADE UPGRADE IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy
CVE-2026-10025 HIGH 8.2 DOWNGRADE IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity (
CVE-2026-17617 HIGH 8.5 UPGRADE IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to
CVE-2026-12762 MEDIUM 5.3 DOWNGRADE IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obta
CVE-2026-18531 MEDIUM 5.3 UPGRADE IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due t
CVE-2026-13477 MEDIUM 4.7 DOWNGRADE IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated
CVE-2026-15656 MEDIUM 4.3 UPGRADE IBM Maximo Application Suite 9.2, 9.1, and 9.0 does not set the secure attribute on authorization tokens or se
CVE-2026-12730 LOW 3.8 DOWNGRADE IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.
CVE-2026-12155 MEDIUM 6.5 UPGRADE DOWNGRADE IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multica
CVE-2026-12148 HIGH 7.5 UPGRADE DOWNGRADE IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbi
CVE-2026-11831 MEDIUM 5.4 UPGRADE DOWNGRADE IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited info
CVE-2026-11829 MEDIUM 6.5 UPGRADE DOWNGRADE IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset
CVE-2026-18683 HIGH 8.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i
CVE-2026-17095 HIGH 8.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
CVE-2026-18499 HIGH 8.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation w
CVE-2026-18847 HIGH 8.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoof
CVE-2026-18098 HIGH 8.1 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and c
CVE-2026-16694 MEDIUM 6.4 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting
CVE-2026-17094 MEDIUM 4.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and m
CVE-2026-18106 MEDIUM 4.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due t
CVE-2026-18144 MEDIUM 4.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
CVE-2026-18246 LOW 3.0 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
CVE-2026-16956 CRITICAL 9.8 UPGRADE IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to impr
CVE-2026-17218 CRITICAL 9.8 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds w
CVE-2026-17083 CRITICAL 9.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buff
CVE-2026-16860 CRITICAL 9.9 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an u
CVE-2026-16906 HIGH 8.8 DOWNGRADE IBM i 7.6, and 7.5 could allow a remote authenticated attacker to execute arbitrary commands with elevated pri
CVE-2026-17417 HIGH 8.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to
CVE-2026-17642 HIGH 8.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to
CVE-2026-17110 HIGH 8.8 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obt
CVE-2026-18669 HIGH 8.8 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to a privilege escalation as the result of a remote code execution
CVE-2026-17485 HIGH 8.2 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and obtain sensitive i
CVE-2026-16931 HIGH 7.5 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper handli
CVE-2026-17271 HIGH 7.5 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper valida
CVE-2026-17276 CRITICAL 9.6 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to imprope
CVE-2026-18713 HIGH 8.8 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to privilege escalation via Navigator for i
CVE-2026-17445 HIGH 8.2 DOWNGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
CVE-2026-10543 HIGH 8.2 UPGRADE IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a speciall
CVE-2026-16856 HIGH 8.8 DOWNGRADE IBM i 7.6, and 7.5 could allow a local attacker to gain elevated privileges due to improper neutralization of
CVE-2026-12004 HIGH 8.7 UPGRADE UPGRADE IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Ve
CVE-2026-13361 HIGH 8.8 UPGRADE IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field.
CVE-2026-17082 HIGH 8.8 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to im
CVE-2026-13105 HIGH 8.8 UPGRADE IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal exploit when i
CVE-2026-18235 HIGH 8.3 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language
CVE-2026-13476 HIGH 7.3 UPGRADE IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary co
CVE-2026-16904 HIGH 8.1 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to
CVE-2026-16907 HIGH 7.6 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to impr
CVE-2026-16863 HIGH 7.7 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due t
CVE-2026-18099 HIGH 8.9 DOWNGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due
CVE-2026-10534 HIGH 8.4 UPGRADE IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT pa
CVE-2026-12005 HIGH 7.2 UPGRADE UPGRADE IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Ve
CVE-2026-17111 HIGH 7.6 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection
CVE-2026-17248 HIGH 7.1 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to i
CVE-2026-17266 MEDIUM 6.5 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due t
CVE-2026-17418 HIGH 8.5 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to im
CVE-2026-17419 MEDIUM 6.5 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper
CVE-2026-13433 HIGH 8.3 UPGRADE IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product c
CVE-2026-17268 MEDIUM 6.8 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
CVE-2026-13094 HIGH 7.8 UPGRADE IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows wh
CVE-2026-16695 HIGH 7.8 UPGRADE IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 could allow a local attacker to execute arbitrary code
CVE-2026-17420 MEDIUM 6.3 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due t
CVE-2026-13367 HIGH 7.8 DOWNGRADE IBM Informix Dynamic Server 14.10, and 15.0 contain a local privilege escalation vulnerability in the oninit s
CVE-2026-14866 HIGH 7.7 UPGRADE IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authori
CVE-2026-18250 MEDIUM 6.3 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and b
CVE-2026-17109 MEDIUM 4.3 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a com
CVE-2026-18097 MEDIUM 5.5 UPGRADE UPGRADE IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Ser
CVE-2026-17222 MEDIUM 4.3 UPGRADE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables
CVE-2026-18148 MEDIUM 4.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navi
CVE-2026-16480 MEDIUM 4.3 UPGRADE IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerabilit
CVE-2026-18150 MEDIUM 4.3 MITIGATE IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due t
CVE-2026-18096 LOW 3.3 DOWNGRADE DOWNGRADE IBM Db2 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to cause
CVE-2026-7366 MEDIUM 4.2 UPGRADE IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM D
CVE-2026-12343 MEDIUM 6.5 UPGRADE DOWNGRADE IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 m
CVE-2026-12350 MEDIUM 6.5 UPGRADE DOWNGRADE IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted async
CVE-2026-12660 LOW 2.7 UPGRADE DOWNGRADE IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory du
CVE-2026-12665 HIGH 8.1 UPGRADE DOWNGRADE IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing
CVE-2026-12669 LOW 3.1 UPGRADE DOWNGRADE IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed comp
CVE-2026-12670 MEDIUM 5.3 UPGRADE DOWNGRADE IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message
CVE-2026-12727 MEDIUM 4.3 UPGRADE DOWNGRADE IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffe
CVE-2026-14511 MEDIUM 6.5 DOWNGRADE IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a spe
CVE-2026-102917 HIGH 7.8 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege
CVE-2026-107674 MEDIUM 5.1 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for Sys
CVE-2026-17068 MEDIUM 5.4 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper e
CVE-2026-17073 MEDIUM 5.4 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtr
CVE-2026-17275 LOW 3.7 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed
CVE-2026-17488 MEDIUM 4.3 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due t
CVE-2026-17491 MEDIUM 5.4 DOWNGRADE IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions du
CVE-2026-10572 HIGH 8.8 UPGRADE DOWNGRADE IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary cod
CVE-2026-10574 HIGH 8.8 UPGRADE DOWNGRADE IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary cod
CVE-2026-10743 HIGH 8.8 UPGRADE DOWNGRADE IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper va
CVE-2026-11828 MEDIUM 5.9 UPGRADE DOWNGRADE IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted cha
CVE-2026-93909 CRITICAL 9.1 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypas
CVE-2026-93905 HIGH 8.2 UPGRADE IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote at
CVE-2026-93895 CRITICAL 9.1 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote a
CVE-2026-95695 HIGH 7.4 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass
CVE-2026-95696 MEDIUM 6.5 UPGRADE IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause

FAQ

How do I fix ibm vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is ibm being exploited right now?

None of the tracked ibm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which ibm CVE should I patch first?

CVE-2026-14512 currently ranks highest (58/100): IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deseriali.

Products

← Back to latest CVEs