IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed
Summary
| CVE | CVE-2026-18658 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-04 16:17:21 UTC |
| Updated | 2026-09-10 21:17:23 UTC |
| Description | IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution. |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.004320000 probability, percentile 0.363990000 (date 2026-09-10)
Problem Types: CWE-89 | CWE-89 CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | IBM | Operational Decision Manager | affected 9.6.0.0 | Not specified |
| CNA | IBM | Operational Decision Manager | affected 9.5.0.0 | Not specified |
| CNA | IBM | Operational Decision Manager | affected 8.11.1.0 | Not specified |
| CNA | IBM | Operational Decision Manager | affected 8.11.0.1 | Not specified |
| CNA | IBM | Operational Decision Manager | affected 8.12.0.1 | Not specified |
| CNA | IBM | Operational Decision Manager | affected 9.5.0.1 | Not specified |
| CNA | IBM | Operational Decision Manager | affected 9.0.0.1 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.ibm.com/support/pages/node/7286196 | [email protected] | www.ibm.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: IBM strongly recommends addressing the vulnerability now by upgrading. IBM Operational Decision Manager V8.11.0.1 Interim fix 060 is available, see download document https://www.ibm.com/support/pages/node/7283100 . IBM Operational Decision Manager V8.11.1: Interim fix 059 is available, see download document https://www.ibm.com/support/pages/node/7282614 . IBM Operational Decision Manager V8.12.0.1: Interim fix 043 is available, see download document https://www.ibm.com/support/pages/node/7282466 . IBM Operational Decision Manager V9.0.0.1: Interim fix 029 is available, see download document https://www.ibm.com/support/pages/node/7282488 . IBM Operational Decision Manager V9.5.0.1: Interim fix 017 is available, see download document https://www.ibm.com/support/pages/node/7233740 . IBM Operational Decision Manager V9.6.0.0: Interim fix 004 is available, see download document https://www.ibm.com/support/pages/node/7273804 .