CVE-2026-5065

Vulnerability

IBM Controller versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contain hard-coded credentials, such as passwords or cryptographic keys, that are used for inbound authentication, outbound communication to external components, or encryption of internal data [1]. This vulnerability exists in the default configuration and does not require any special conditions to be reachable.

Exploitation

An attacker with network access to the IBM Controller can leverage the hard-coded credentials to authenticate to the system without needing valid user credentials. No prior authentication or user interaction is required. The attacker can directly use the embedded credentials to gain access to the controller's interfaces or services [1].

Impact

Successful exploitation allows an attacker to bypass authentication mechanisms, potentially gaining full administrative control over the IBM Controller. This can lead to unauthorized access to sensitive data, modification of system configurations, and disruption of operations, depending on the scope of the hard-coded credentials [1].

Mitigation

As of the publication date, no fix version or workaround has been disclosed in the available reference [1]. Organizations should monitor IBM's security advisory for updates and consider network segmentation to limit exposure until a patch is released.