Riskcovery

CVE-2026-18658

IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed

State
Published
Severity
9.8 Critical
Published
Sep 4, 2026
Updated
Sep 11, 2026
Reserved
Aug 3, 2026

Read the record on cve.org

Description

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hibm

Weaknesses

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

ProductVersions
Operational Decision ManagerIBM
  • 9.6.0.0Affected
  • 9.5.0.0Affected
  • 8.11.1.0Affected
  • 8.11.0.1Affected
  • 8.12.0.1Affected
  • 9.5.0.1Affected
  • 9.0.0.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.