IBM: 25 Vulnerabilities Across Multiple Products Disclosed in Coordinated Batch
IBM disclosed 25 vulnerabilities across multiple products, including critical RCE flaws in DataStage and IBM i, on October 12-13, 2026.
Key findings
- 25 IBM vulnerabilities disclosed across multiple products in a single 1-hour window on Oct 12-13, 2026.
- Critical RCE and information disclosure flaws found in IBM DataStage on Cloud Pak for Data 5.4.0.0.
- IBM i systems affected by critical RCE and multiple high/medium severity vulnerabilities.
- IBM TRIRIGA, Aspera Enterprise WebApps, and Planning Analytics also impacted by numerous high and medium severity flaws.
- Patches and updates are available; prompt remediation is critical for all affected IBM products.
On October 12-13, 2026, a significant batch of 25 vulnerabilities was disclosed across multiple IBM products, including IBM i, IBM TRIRIGA Application Platform, IBM Aspera Enterprise WebApps, IBM Planning Analytics, and IBM DataStage on Cloud Pak for Data. This coordinated disclosure event highlights a broad range of security weaknesses, from critical remote code execution flaws to medium-severity information disclosure and denial-of-service vulnerabilities. The sheer volume and variety of these issues underscore the importance of timely patching and security diligence for IBM customers.
A cluster of critical vulnerabilities affecting IBM DataStage on Cloud Pak for Data 5.4.0.0 warrants particular attention. CVE-2026-82110, CVE-2026-82103, and CVE-2026-82101, all rated Critical with CVSSv3 scores of 9.6, present severe risks. CVE-2026-82110 allows for remote code execution via path traversal, CVE-2026-82103 enables sensitive information exposure, and CVE-2026-82101 can lead to denial of service, also through path traversal. Additionally, CVE-2026-82108 and CVE-2026-82096, both rated High with CVSSv3 scores of 8.8, allow remote authenticated attackers to execute arbitrary code due to improper neutralization of OS command elements. A Man-in-the-Middle attack is also possible via CVE-2026-84418 (High, CVSSv3 7.4) by presenting a forged TLS certificate to intercept authentication tokens. These DataStage vulnerabilities were detailed in coverage by Vypr Intelligence.
IBM i systems are also impacted by several vulnerabilities, including a Critical flaw, CVE-2026-96119 (CVSSv3 9.9), which could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code due to improper data sanitization in the HTTP Server Administration web application. Other IBM i vulnerabilities include High severity CVE-2026-93886 (CVSSv3 8.3) for remote script code execution and several Medium severity issues such as CVE-2026-81858 (CVSSv3 5.4) for denial of service and information disclosure in the File Server, CVE-2026-18343 (CVSSv3 4.4) for local modification of the BOOTP table, CVE-2026-18318 (CVSSv3 5.3) for brute-force credential attacks, CVE-2026-17487 (CVSSv3 5.3) for user profile enumeration, and CVE-2026-17484 (CVSSv3 5.3) for local denial of service.
IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 are affected by two High severity vulnerabilities disclosed on October 12, 2026. CVE-2026-93892 (CVSSv3 8.1) allows a remote authenticated attacker to obtain sensitive information by exposing session tokens in the HTML response. CVE-2026-93891 (CVSSv3 7.6) is an XML external entity (XXE) injection flaw that also permits sensitive information disclosure.
IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 face several vulnerabilities. High severity CVE-2026-75782 (CVSSv3 7.8) allows local attackers to gain elevated privileges due to a misconfigured PATH environment variable. CVE-2026-75095 (CVSSv3 7.5) is a High severity denial-of-service vulnerability due to uncontrolled resource consumption. Medium severity flaws include CVE-2026-92832 (CVSSv3 5.1) for cleartext transmission of sensitive information, CVE-2026-75621 (CVSSv3 6.2) for obtaining sensitive information due to excessive permissions, and CVE-2026-75076 (CVSSv3 4.3) for sensitive information exposure via JavaScript source map files.
IBM Planning Analytics versions 2.0 and 2.1 are affected by multiple High and Medium severity vulnerabilities. CVE-2026-85457 (High, CVSSv3 8.1) allows remote authenticated attackers to execute arbitrary code due to a stack-based buffer overflow. CVE-2026-75063 (Medium, CVSSv3 5.4) permits arbitrary JavaScript execution due to improper output encoding. CVE-2026-75061 (High, CVSSv3 7.5) allows directory traversal and arbitrary file writes. CVE-2026-19627 (High, CVSSv3 8.2) enables reading arbitrary host files and overwriting application files due to improper validation of file paths. Finally, CVE-2026-19622 (High, CVSSv3 8.8) allows bypass of authentication and privilege escalation due to improper validation of sub-requests.
IBM has released patches and updates to address these vulnerabilities. Customers are strongly advised to consult IBM's official security advisories for specific version information and remediation steps. Prompt application of these updates is crucial to mitigate the risks associated with these numerous security flaws across IBM's product portfolio.
This extensive batch of vulnerabilities, disclosed within a short 1-hour window, emphasizes the critical need for continuous security monitoring and rapid patching for users of IBM products. The range of affected products and the severity of the flaws, including multiple critical remote code execution and information disclosure vulnerabilities, present a significant risk landscape that demands immediate attention from system administrators and security teams.
CVE-2026-96119, CVE-2026-93886, CVE-2026-81858, CVE-2026-18343, CVE-2026-18318, CVE-2026-17487, CVE-2026-17484, CVE-2026-93892, CVE-2026-93891, CVE-2026-92832, CVE-2026-85457, CVE-2026-84418, CVE-2026-82110, CVE-2026-82108, CVE-2026-82103, CVE-2026-82101, CVE-2026-82096, CVE-2026-75782, CVE-2026-75621, CVE-2026-75095, CVE-2026-75076, CVE-2026-75063, CVE-2026-75061, CVE-2026-19627, CVE-2026-19622