FAIL › dossier
IBM
COMPANY FEDRAMP MARKETFedRAMP provider · · dossier confidence 20%
IBM is a major public technology vendor with a significant security footprint in enterprise software. Recent 2026 data reveals a pattern of critical RCE and XXE vulnerabilities across WebSphere, API Connect, and IBM i, indicating a need for rigorous patch management.
PROFILE
CategoryTechnology VendorWhat they doIBM is a multinational technology corporation that develops, manufactures, and supports hardware, software, and related services.
Websitehttps://www.ibm.com ↗
SECURITY POSTURE
IBM demonstrates a high volume of critical and high-severity vulnerabilities across its enterprise software portfolio (WebSphere, API Connect, IBM i) in 2026, with multiple RCE and XXE flaws affecting widely deployed components.
Notable failures
- CVE-2026-9074: Unauthenticated SQL injection in API Connect password reset
- CVE-2026-13772: RCE in WebSphere Extreme Scale via Class.forName()
- CVE-2026-13449: XXE in Business Automation Manager Open Editions
- CVE-2026-11541: HTTP request smuggling in WebSphere Application Server
- CVE-2026-11714: SSRF in WebSphere Liberty apiDiscovery-1.0
- CVE-2026-11546: SSRF in WebSphere Liberty adminCenter-1.0
Patterns: Repeated unpatched edge-device RCEs; Default credentials in API Connect; XXE in XML processing components; SSRF in Liberty features
FAILURE HISTORY · 60
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2026-08-19 | CVE-2026-16919 | critical | IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 suffer a critical remote code execution flaw from improper pointer validation. |
| 2023-02-21 | CVE-2022-47986 | critical | A YAML deserialization flaw in IBM Aspera Faspex allowed remote attackers to execute code, leading to ransomware-linked incidents. |
| 2022-05-25 | CVE-2013-3993 | critical | IBM InfoSphere BigInsights APIs accepted invalid input allowing attackers to read, write, modify, or delete data. |
| 2021-11-03 | CVE-2019-4716 | high | IBM Planning Analytics allowed unauthenticated remote code execution via configuration overwrite, enabling root-level access. |
| 2026-08-12 | CVE-2026-16860 | critical | IBM i 7.3-7.6 systems allow remote authenticated attackers to execute arbitrary code via an uncontrolled search path element. |
| 2022-01-10 | CVE-2015-7450 | high | Remote attackers could execute arbitrary commands via serialized-object interfaces in IBM WebSphere Application Server and Server Hypervisor Edition. |
| 2021-11-03 | CVE-2020-4427 | high | A remote attacker could bypass SAML authentication in IBM Data Risk Manager to gain full administrative access. |
| 2026-08-04 | CVE-2026-9198 | high | IBM Langflow Code Injection Vulnerability allows RCE. |
| 2026-08-12 | CVE-2026-17276 | critical | IBM i 7.3-7.6 privilege escalation flaw allows authenticated remote attackers to escalate privileges via improper high-authority thread handling. |
| 2026-07-29 | CVE-2026-14529 | critical | IBM WebSphere Application Server 9.0, 8.5, and Liberty 17.0.0.3 through 26.0.0.8 with SIP container feature enabled is vulnerable to SSRF. |
| 2021-11-03 | CVE-2020-4430 | high | IBM Data Risk Manager suffered a directory traversal vulnerability allowing authenticated attackers to download arbitrary files. |
| 2021-11-03 | CVE-2020-4428 | high | IBM Data Risk Manager had a remote code execution vulnerability allowing authenticated attackers to execute commands on the system. |
| 2026-07-08 | CVE-2026-9074 | critical | IBM API Connect versions 10.0.8.0–10.0.8.9 and 12.1.0.0–12.1.0.3 contain an unauthenticated SQL injection vulnerability in the password reset functionality. |
| 2026-06-30 | CVE-2026-13772 | high | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); |
| 2026-06-22 | CVE-2026-9072 | high | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty - when using Intelligent Management with the WebSphere WebServer Plug-in component - are vulnerable to remote code execution and denial of service. This vulnerability can be exploited when an attacker i |
| 2026-06-30 | CVE-2026-13773 | medium | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink |
| 2026-07-08 | CVE-2026-3144 | high | IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update. |
| 2026-06-30 | CVE-2026-13449 | high | IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. |
| 2026-06-30 | CVE-2026-11541 | high | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability. |
| 2026-06-30 | CVE-2026-11546 | high | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. |
| 2026-06-30 | CVE-2026-11714 | high | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled. |
| 2026-10-12 | CVE-2026-19622 | high | CVE-2026-19622: IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass auth |
| 2026-10-08 | CVE-2026-82334 | high | CVE-2026-82334: IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out- |
| 2026-10-08 | CVE-2026-84246 | high | CVE-2026-84246: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker |
| 2026-10-08 | CVE-2026-84209 | high | CVE-2026-84209: IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to e |
| 2026-10-08 | CVE-2026-84198 | high | CVE-2026-84198: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker |
| 2026-10-08 | CVE-2026-84058 | high | CVE-2026-84058: IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer over |
| 2026-10-08 | CVE-2026-81932 | high | CVE-2026-81932: IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection |
| 2026-10-08 | CVE-2026-14988 | medium | CVE-2026-14988: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0. |
| 2026-10-08 | CVE-2026-14888 | high | CVE-2026-14888: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0. |
| 2026-10-08 | CVE-2026-14508 | medium | CVE-2026-14508: IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0. |
| 2026-10-08 | CVE-2026-82900 | high | CVE-2026-82900: IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to d |
| 2026-10-08 | CVE-2026-82895 | high | CVE-2026-82895: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker |
| 2026-10-08 | CVE-2026-84035 | high | CVE-2026-84035: IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker |
| 2026-10-08 | CVE-2026-84057 | high | CVE-2026-84057: IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to e |
| 2026-10-08 | CVE-2026-82344 | high | CVE-2026-82344: IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer ove |
| 2026-10-08 | CVE-2026-82335 | high | CVE-2026-82335: IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buff |
| 2026-09-22 | CVE-2026-17618 | high | CVE-2026-17618: IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot |
| 2026-09-18 | CVE-2026-10027 | high | CVE-2026-10027: IBM MQ could allow a remote attacker to cause a denial of service or execute arb |
| 2026-09-04 | CVE-2026-77822 | high | CVE-2026-77822: IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obta |
| 2026-09-04 | CVE-2026-17207 | medium | CVE-2026-17207: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of |
| 2026-09-04 | CVE-2026-17057 | medium | CVE-2026-17057: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of |
| 2026-09-04 | CVE-2026-18221 | high | CVE-2026-18221: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized |
| 2026-08-20 | CVE-2026-17060 | high | CVE-2026-17060: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o |
| 2026-08-20 | CVE-2026-17138 | high | CVE-2026-17138: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e |
| 2026-08-20 | CVE-2026-17423 | high | CVE-2026-17423: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o |
| 2026-08-20 | CVE-2026-18716 | high | CVE-2026-18716: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated |
| 2026-08-20 | CVE-2026-19437 | high | CVE-2026-19437: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e |
| 2026-08-20 | CVE-2026-17436 | high | CVE-2026-17436: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e |
| 2026-08-20 | CVE-2026-18832 | high | CVE-2026-18832: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e |
| 2026-08-20 | CVE-2026-18670 | high | CVE-2026-18670: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c |
| 2026-08-20 | CVE-2026-17000 | high | CVE-2026-17000: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e |
| 2026-08-20 | CVE-2026-17003 | high | CVE-2026-17003: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c |
| 2026-08-20 | CVE-2026-17006 | high | CVE-2026-17006: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e |
| 2026-08-20 | CVE-2026-17024 | high | CVE-2026-17024: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e |
| 2026-08-13 | CVE-2026-16867 | high | CVE-2026-16867: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server reso |
| 2026-08-13 | CVE-2026-17206 | high | CVE-2026-17206: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary |
| 2026-08-13 | CVE-2026-18249 | high | CVE-2026-18249: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain |
| 2026-08-13 | CVE-2026-18193 | high | CVE-2026-18193: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security re |
| 2026-08-13 | CVE-2026-17101 | high | CVE-2026-17101: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary |
SENTIMENT · TRUSTED SOURCES
synthesissevere-fallout-0.60
Remote code execution in core IBM products is a severe vulnerability affecting multiple product lines, indicating significant security oversight and potential for widespread exploitation.
synthesissevere-fallout-0.80
Critical vulnerability allowing unauthenticated admin access and code execution as root
synthesissevere-fallout-0.80
IBM Data Risk Manager vulnerability allows remote attackers to bypass SAML authentication and gain full administrative access via specially crafted HTTP requests, representing a critical security fail
synthesissevere-fallout-0.80
IBM Data Risk Manager vulnerability allows remote authenticated attackers to execute commands, representing a critical security failure.
synthesissevere-fallout-0.80
IBM's vulnerability in Data Risk Manager was widely recognized as critical, with the CVE listed in NVD and CISA KEV, indicating severe security impact and vendor responsibility.
Remote code execution in core IBM products is a severe vulnerability affecting multiple product lines, indicating significant security oversight and potential for widespread exploitation.
"Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands"
Irrelevant to IBM
"This document lists security updates for Apple software."
Vulnerability tracked in CVE database
"CVE 2020-4430 is listed in the database of publicly disclosed computer security flaws."
Vulnerability tracked in Shodan CVEDB
"The CVEDB API offers a quick way to check information about vulnerabilities in a service."
Irrelevant to IBM
"Data Breach Directory & Database: Browse 760+ Known Breaches"
Vulnerability tracked in OpenCVE
"CVEs and Security Vulnerabilities - OpenCVE"
Critical vulnerability disclosed
"IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system."
Critical vulnerability allowing unauthenticated admin access and code execution as root
"IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as 'admin', and then execute code as root or SYSTEM via TM1 scripting."
Critical vulnerability allows remote command execution
"IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system."
Critical vulnerability allows remote attackers to bypass SAML authentication and gain full administrative access.
"IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system."
FEDRAMP CATALOG PRODUCTS · 5
| PRODUCT | STATUS | IMPACT |
|---|---|---|
| IBM Cloud for Government | Authorized | High |
| IBM Federal HR Cloud | Authorized | Moderate |
| IBM Maximo and TRIRIGA on Cloud for U.S. Federal | Authorized | Moderate |
| MaaS360 Enterprise Mobility Management | Authorized | Moderate |
| SmartCloud for Government | Authorized | High |
DOSSIER SOURCES
- IBM (IBM) Company Profile, CEO, Owner, Founder, Headquarters, Market ... · www.gizbot.com
- Security Bulletin: IBM WebSphere Application Server Liberty, which is ... · www.ibm.com
- Security Bulletin: Due to use of IBM Storage Protect, IBM Cloud Pak ... · www.ibm.com
- IBM i 関連の脆弱性情報 | iWorld · iworldweb.info
- Security Bulletin: IBM Application Modernization Accelerator is ... · www.ibm.com
- Security Bulletin: IBM Operational Decision Manager for May 2026 ... · www.ibm.com
- Vulnerability Report Archives • Daily CyberSecurity · securityonline.info
Open questions: IBM's remediation timeline for the 2026-06-30 batch of vulnerabilities · Whether these vulnerabilities are currently in CISA KEV
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-07-14 03:49:47.027259+00:00