by Kastro
Paper/Archive/CVE-2026-18658

CVE-2026-18658

IBM Operational Decision Manager — IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.8.558 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

Affected

ProductAffectedFixed inSource
Operational Decision Manager9.6.0.0–CNA
Operational Decision Manager9.5.0.0–CNA
Operational Decision Manager8.11.1.0–CNA
Operational Decision Manager8.11.0.1–CNA
Operational Decision Manager8.12.0.1–CNA
Operational Decision Manager9.5.0.1–CNA
Operational Decision Manager9.0.0.1–CNA

Scores by source

ibm (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchibm.com/support/pages/node/7286196