{"api_version":"1","generated_at":"2026-09-11T10:38:56+00:00","cve":"CVE-2026-18658","urls":{"html":"https://cve.report/CVE-2026-18658","api":"https://cve.report/api/cve/CVE-2026-18658.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-18658","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-18658"},"summary":{"title":"IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed","description":"IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-09-04 16:17:21","updated_at":"2026-09-10 21:17:23"},"problem_types":["CWE-89","CWE-89 CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7286196","name":"https://www.ibm.com/support/pages/node/7286196","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18658","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18658","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"Operational Decision Manager","version":"affected 9.6.0.0","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Operational Decision Manager","version":"affected 9.5.0.0","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Operational Decision Manager","version":"affected 8.11.1.0","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Operational Decision Manager","version":"affected 8.11.0.1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Operational Decision Manager","version":"affected 8.12.0.1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Operational Decision Manager","version":"affected 9.5.0.1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"Operational Decision Manager","version":"affected 9.0.0.1","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"IBM strongly recommends addressing the vulnerability now by upgrading.\n\n\n\nIBM Operational Decision Manager V8.11.0.1\nInterim fix 060 is available, see  download document https://www.ibm.com/support/pages/node/7283100 .\n\n\n\nIBM Operational Decision Manager V8.11.1:\nInterim fix 059 is available, see  download document https://www.ibm.com/support/pages/node/7282614 .\n\n\n\nIBM Operational Decision Manager V8.12.0.1:\nInterim fix 043 is available, see  download document https://www.ibm.com/support/pages/node/7282466 .\n\n\n\nIBM Operational Decision Manager V9.0.0.1:\nInterim fix 029 is available, see  download document https://www.ibm.com/support/pages/node/7282488 .\n\n\n\n IBM Operational Decision Manager V9.5.0.1:\nInterim fix 017 is available, see  download document https://www.ibm.com/support/pages/node/7233740 .\n\n\n\n IBM Operational Decision Manager V9.6.0.0:\nInterim fix 004 is available, see  download document https://www.ibm.com/support/pages/node/7273804 .","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"18658","cve":"CVE-2026-18658","epss":"0.004320000","percentile":"0.363990000","score_date":"2026-09-10","updated_at":"2026-09-11 00:05:15"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-18658","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-09-10T20:38:13.682174Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-09-10T21:00:34.810Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"cpes":["cpe:2.3:a:ibm:operational_decision_manager:9.6.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:9.5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:9.5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:*:*:*:*:*:*:*"],"product":"Operational Decision Manager","vendor":"IBM","versions":[{"status":"affected","version":"9.6.0.0"},{"status":"affected","version":"9.5.0.0"},{"status":"affected","version":"8.11.1.0"},{"status":"affected","version":"8.11.0.1"},{"status":"affected","version":"8.12.0.1"},{"status":"affected","version":"9.5.0.1"},{"status":"affected","version":"9.0.0.1"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.</p>"}],"value":"IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-04T16:10:18.743Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7286196"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>IBM strongly recommends addressing the vulnerability now by upgrading.</p><p>IBM Operational Decision Manager V8.11.0.1<br/>Interim fix 060 is available, see <a href=\"https://www.ibm.com/support/pages/node/7283100\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V8.11.1:<br/>Interim fix 059 is available, see <a href=\"https://www.ibm.com/support/pages/node/7282614\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V8.12.0.1:<br/>Interim fix 043 is available, see <a href=\"https://www.ibm.com/support/pages/node/7282466\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V9.0.0.1:<br/>Interim fix 029 is available, see <a href=\"https://www.ibm.com/support/pages/node/7282488\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p> IBM Operational Decision Manager V9.5.0.1:<br/>Interim fix 017 is available, see <a href=\"https://www.ibm.com/support/pages/node/7233740\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p> IBM Operational Decision Manager V9.6.0.0:<br/>Interim fix 004 is available, see <a href=\"https://www.ibm.com/support/pages/node/7273804\" rel=\"nofollow noopener noreferrer\">download document</a>.</p>"}],"value":"IBM strongly recommends addressing the vulnerability now by upgrading.\n\n\n\nIBM Operational Decision Manager V8.11.0.1\nInterim fix 060 is available, see  download document https://www.ibm.com/support/pages/node/7283100 .\n\n\n\nIBM Operational Decision Manager V8.11.1:\nInterim fix 059 is available, see  download document https://www.ibm.com/support/pages/node/7282614 .\n\n\n\nIBM Operational Decision Manager V8.12.0.1:\nInterim fix 043 is available, see  download document https://www.ibm.com/support/pages/node/7282466 .\n\n\n\nIBM Operational Decision Manager V9.0.0.1:\nInterim fix 029 is available, see  download document https://www.ibm.com/support/pages/node/7282488 .\n\n\n\n IBM Operational Decision Manager V9.5.0.1:\nInterim fix 017 is available, see  download document https://www.ibm.com/support/pages/node/7233740 .\n\n\n\n IBM Operational Decision Manager V9.6.0.0:\nInterim fix 004 is available, see  download document https://www.ibm.com/support/pages/node/7273804 ."}],"title":"IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-18658","datePublished":"2026-09-04T16:10:18.743Z","dateReserved":"2026-08-03T13:15:01.738Z","dateUpdated":"2026-09-10T21:00:34.810Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-04 16:17:21","lastModifiedDate":"2026-09-10 21:17:23","problem_types":["CWE-89","CWE-89 CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-10T20:38:13.682174Z","id":"CVE-2026-18658","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"18658","Ordinal":"1","Title":"IBM Operational Decision Manager for Aug 2026 - Multiple CVEs ad","CVE":"CVE-2026-18658","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"18658","Ordinal":"1","NoteData":"IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.","Type":"Description","Title":"IBM Operational Decision Manager for Aug 2026 - Multiple CVEs ad"}]}}}