Advisoriesby IbisIBMCVE-2026-18658
IBM Operational Decision Manager: SQL injection
No fix yet
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Operational Decision Manager Product | <= 9.6.0.0 | No fix yet |
| <= 9.5.0.0 | No fix yet | |
| <= 8.11.1.0 | No fix yet | |
| <= 8.11.0.1 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-89