Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management for August 2026

Summary IBM SevOne Network Performance Management has addressed these security vulnerabilities in the NMS component including Streaming Telemetry with a Service Pack update. The publication of this security bulletin represents a change in our communication process, not an increase in security...

Security Bulletin: IBM WebSphere Application Server - Liberty is affected by multiple vulnerabilities - 26.0.0.8

Summary IBM WebSphere Application Server Liberty is shipped as a supporting program of IBM OpenPages. Information about multiple vulnerabilities affecting IBM WebSphere Application Server Liberty has been published in a security bulletin. These products have addressed the applicable CVEs. For a...

Security Bulletin: Multiple Vulnerabilities affect VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service

Summary Multiple vulnerabilities have been addressed in components of VM Manager Tool and Scans Relay as part of IBM License Metric Tool Software as a Service Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network...

Security Bulletin: Multiple Vulnerabilities were found in IBM License Metric Tool

Summary Multiple vulnerabilities have been addressed in components used by IBM License Metric Tool Vulnerability Details CVEID:CVE-2026-65432 DESCRIPTION: Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any wsdl:import...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in postcss-selector-parser (CVE-2026-9358)

Summary A Regular Expression Denial of Service ReDoS vulnerability in the postcss-selector-parser library CVE-2026-9358 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 7.1.4. Vulnerability Details CVEID:CVE-2026-9358 DESCRIPTION: A vulnerabilit...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in js-yaml (CVE-2026-53550)

Summary A Denial of Service vulnerability in the js-yaml document parsing library CVE-2026-53550 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.3.1. Vulnerability Details CVEID:CVE-2026-53550 DESCRIPTION: js-yaml is a JavaScript YAML parser...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in nanoid (CVE-2026-73086)

Summary A predictable unique ID generation vulnerability in the nanoid generator library CVE-2026-73086 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.3.17. Vulnerability Details CVEID:CVE-2026-73086 DESCRIPTION: nanoid is a secure,...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in PySpark (CVE-2025-55039)

Summary A deserialization vulnerability in the PySpark component CVE-2025-55039 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.5.8. Vulnerability Details CVEID:CVE-2025-55039 DESCRIPTION: This issue affects Apache Spark versions before 3.4.4...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in python-multipart (CVE-2026-24486, CVE-2026-40347, CVE-2026-42561)

Summary Multiple vulnerabilities including path traversal and Denial of Service in the python-multipart streaming parser library CVE-2026-24486, CVE-2026-40347, CVE-2026-42561 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 0.0.32. Vulnerabili...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in DOMPurify (CVE-2026-65898, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65912, CVE-2026-65913, CVE-2026-65914)

Summary Multiple HTML sanitization and mutation Cross-Site Scripting mXSS vulnerabilities in the DOMPurify library CVE-2026-65898, CVE-2026-65899, CVE-2026-65900, CVE-2026-65901, CVE-2026-65902, CVE-2026-65903, CVE-2026-65912, CVE-2026-65913, CVE-2026-65914 used by IBM InfoSphere Optim Archive...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-13676)

Summary A domain label parsing boundary vulnerability in the fast-uri URI parsing library CVE-2026-13676 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-11979 DESCRIPTION: libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell functi...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Apache Hive

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in Apache Hive. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-49845 DESCRIPTION: SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on...

Security Bulletin: IBM SPSS Modeler is affected by an Apache Hive SSRF vulnerability that could allow authenticated users to trigger requests to attacker-controlled URLs

Summary IBM SPSS Modeler is affected by an Apache Hive SSRF vulnerability that could allow authenticated users to trigger requests to attacker-controlled URLs. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-55976 DESCRIPTION: Server-Side Request Forgery...

Security Bulletin: Resolved XSS vulnerability in DOMPurify (CVE-2026-75838)

Summary Carbon Charts has updated its DOMPurify dependency from ^3.4.12 to ^3.4.14, resolving CVE-2026-75838 Medium, CVSS 5.4 — an XSS vulnerability caused by improper INPLACE sanitization in DOMPurify versions prior to 3.4.13. The vulnerability affects the sanitize API used internally by Carbon...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Quarkus Core Security, SmallRye JWT, Hibernate and WebSockets.next Vulnerability Details CVEID:CVE-2026-87743 DESCRIPTION: A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues due to Java SDK

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities reported for IBM Java and are addressed in version 6.1.0.5 Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromis...

Security Bulletin: IBM Sterling Secure Proxy is affected by multiple vulnerabilities in Bouncy Castle for Java FIPS

Summary IBM Sterling Secure Proxy is affected by multiple vulnerabilities CVE-2026-13505, CVE-2026-9563 in Bouncy Castle for Java FIPS and are addressed in version 6.2.1.3. Vulnerability Details CVEID:CVE-2026-13505 DESCRIPTION: In Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X...

Security Bulletin: A vulnerability in OpenSSL affects IBM Rational ClearQuest (CVE-2025-66199)

Summary An OpenSSL vulnerability was disclosed by the OpenSSL Project. OpenSSL is used by IBM Rational ClearQuest. IBM Rational ClearQuest has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2025-66199 DESCRIPTION: Issue summary: A TLS 1.3 connection using certificate compression ca...

Security Bulletin: Vulnerabilities in WebSphere Liberty profile(CVE-2026-14525, CVE-2026-16192, CVE-2026-10571, CVE-2026-14976, CVE-2026-15280, CVE-2026-18499, CVE-2026-14980, CVE-2026-2482, CVE-2026-14529, CVE-2026-10841) affect Power PowerVM Novalink

Summary The WebSphere Liberty profile used by PowerVM Novalink. Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-10571 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure...

Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary extract-zip through 2.0.1 only checks the parent directory of each archive entry, allowing a symlink-then-regular-file pair with identical names to write through the planted symlink and achieve arbitrary file write outside the destination directory. CVSS: 8.1 High, CWE-22. Vulnerability...

Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary extract-zip 2.0.1 does not validate symlink targets during zip extraction, allowing a malicious archive with relative symlink paths to read or write arbitrary files outside the extraction directory. CVSS: 8.1 High, CWE-22. Vulnerability Details CVEID:CVE-2026-56876 DESCRIPTION: extract-zi...

Security Bulletin: IBM Guardium Data Protection is affected by security vulnerability (CVE-2026-43869)

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-43869 DESCRIPTION: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended ...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-42508 DESCRIPTION: Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and...

Security Bulletin: IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat .

Summary IBM ApplinX is vulnerable to multiple issues like improper Access control, Authentication Bypass, Improper Authorization and more due to the use of Apache-Tomcat. The Tomcat version has been updated within IBM ApplinX in order to address the mentioned vulnerabilities. Vulnerability Detail...

Security Bulletin: Due to the use of Bouncy Castle cryptographic libraries, IBM EntireX is vulnerable to multiple vulnerabilities.

Summary Due to the use of Bouncy Castle cryptographic libraries including bctls-fips, bc-fips, bcpkix-jdk18on, and bcprov-jdk18on, IBM EntireX is vulnerable to Improper Validation of Certificate with Host Mismatch, Memory Allocation with Excessive Size Value, Uncontrolled Recursion, Allocation of...

Security Bulletin: IBM Transformation Extender Advanced is affected by multiple Java vulnerabilities.

Summary IBM Transformation Extender Advanced, also known as IBM Standards Processing Engine, is affected by multiple vulnerabilities because it is dependent on Java. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut...

Security Bulletin: Due to the use of Bouncy Castle for Java, IBM Sterling Control Center is vulnerable to Memory Allocation, Improper Validation, Inadequate Encryption Strength, Inefficient Algorithmic Complexity and LDAP Injection.

Summary Bouncy Castle for Java is used by IBM Sterling Control Center as part of dependency in bcprov-jdk18on-1.81.jar Vulnerability Details CVEID:CVE-2026-12185 DESCRIPTION: In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This iss...

Security Bulletin: Due to the use of Bouncy Castle for Java, IBM Sterling Control Center is vulnerable to Uncontrolled Recursion(CVE-2026-59645)

Summary Bouncy Castle for Java is used by IBM Sterling Control Center as part of dependency in bcutil-jdk18on-1.81.jar Vulnerability Details CVEID:CVE-2026-59645 DESCRIPTION: In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. Thi...

Security Bulletin: Due to the use of Apache ActiveMQ All, IBM Sterling Control Center is vulnerable to Improper Authorization and Improper Input Validation (CVE-2026-59878, CVE-2026-61487)

Summary Apache ActiveMQ All is used by IBM Sterling Control Center as part of dependency in activemq-all-5.19.0.jar. Vulnerability Details CVEID:CVE-2026-59878 DESCRIPTION: Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote...

Security Bulletin: Due to the use of Apache HttpComponents Client 5.4, IBM Sterling Control Center is vulnerable to Improper Certificate Validation (CVE-2026-71290)

Summary Apache HttpComponents Client 5.4 is used by IBM Sterling Control Center as part of dependency in httpclient5-5.4.3.jar. Vulnerability Details CVEID:CVE-2026-71290 DESCRIPTION: Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer...

Security Bulletin: Vulnerabilities in IBM SDK, Java Technology (CVE-2026-16440, CVE-2026-61308, CVE-2026-70907, CVE-2026-60589) affect Power PowerVM Novalink

Summary The IBM SDK, Java Technology used by PowerVM Novalink. Novalink has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Java SE. While the...

Security Bulletin: Multiple vulnerabilities that affects IBM Db2 Genius Hub

Summary The following dependency packages are being used by IBM Db2 Genius Hub - node-fetch-3.1.1.tgz, Jinja2-3.0.3-py3-none-any.whl, dompurify-3.4.11.tgz, react-router-6.30.4.tgz, react-router-dom-6.30.4.tgz, brace-expansion-5.0.8.tgz, browserslist-4.26.2.tgz, baseline-browser-mapping-2.10.38.tg...

Security Bulletin: Security Vulnerability identified in jsoup used by IBM Maximo Application Suite - MREF ( CVE-2026-75140 )

Summary There is a vulnerability in jsoup-1.23.1.jar used by IBM Maximo Application Suite - MREF Vulnerability Details CVEID:CVE-2026-75140 DESCRIPTION: jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Code Injection due to Node.js module jsonata (CVE-2026-12208)

Summary IBM App Connect Enterprise Discovery Connectors is vulnerable to Code Injection due to Node.js module jsonata. Vulnerability Details CVEID:CVE-2026-12208 DESCRIPTION: A weakness has been identified in jsonata-js jsonata up to 2.2.0. The affected element is the function createFrame of the...

Security Bulletin: Multiple Vulnerabilities in IBM Concert Software

Summary Multiple vulnerabilities were addressed in IBM Concert Software version 3.0.1.1 Vulnerability Details CVEID:CVE-2026-27794 DESCRIPTION: LangGraph Checkpoint defines the base interface for LangGraph checkpointers. Prior to version 4.0.0, a Remote Code Execution vulnerability exists in...

Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench

Summary Multiple vulnerabilities were addressed in IBM DevOps Solution Workbench version 5.2.2 Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time...

Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty is affected by an XML External Entity Injection vulnerability due to Apache CXF (CVE-2026-65432)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty with jaxws-2.2, xmlWS-3.0, xmlWS-4.0, wsSecurity-1.1 or wsAtomicTransaction-1.2 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: Impacted IBM Optim 1.0.0, 1.1.0 and 1.2.0 by vulnerabilities in libxml2

Summary IBM Optim versions 1.0.0, 1.1.0 and 1.2.0 include an open-source package libxml2 that is affected by three critical-severity vulnerabilities. IBM Optim 2.0.0 resolves these vulnerabilities by upgrading the affected open-source dependency to a fixed version. Vulnerability Details...

Security Bulletin: Vulnarabilities in kernel, glibc, expat, RMC daemon, httpd and mod_http2 libraries (CVE-2026-46333, CVE-2026-4046, CVE-2026-45186, CVE-2026-14514, CVE-2025-53020, CVE-2026-49975) affect Power HMC.

Summary The kernel, glibc, expat, RMC daemon, httpd and modhttp2 libraries are used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-4046 DESCRIPTION: The iconv function in the GNU C Library versions 2.43 and earlier may crash d...

Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition

Summary Multiple vulnerabilities were addressed in IBM Tivoli Network Manager IP Edition 4.2.0.25 Vulnerability Details CVEID:CVE-2026-45205 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons. When processing an untrusted configuration file, Commons Configuration will throw a...

Security Bulletin: Vulnerabilities in Apache Tomcat Server library (CVE-2026-59083, CVE-2026-55956) affect Power HMC.

Summary The Apache Tomcat Server library is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-59083 DESCRIPTION: Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security...

Security Bulletin: Vulnerabilities in xorg-x11-server library (CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50264, CVE-2026-59083, CVE-2026-55999) affect Power HMC.

Summary The xorg-x11-server is used by Power Hardware Management Console HMC. HMC has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2026-55999 DESCRIPTION: Local attackers with a X connection able to provide PCX fonts to the X server xorg-server before 21.2.24 and xwayland before...

Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty is affected by uncontrolled resource consumption vulnerabilities due to Apache Neethi (CVE-2026-66142, CVE-2026-66143, CVE-2026-66144)

Summary There is a vulnerability in the Apache Neethi library that affects IBM WebSphere Application Server Liberty with the jaxws-2.2, xmlWS-3.0, and xmlWS-4.0 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities

Summary The vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Remediator code base. IBM Quantum Safe Remediator has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION:...

Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities

Summary Multiple vulnerabilities are found in the dependent open source libraries used in IBM Quantum Safe Remediator code base. IBM Quantum Safe Remediator has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-75899...

Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a secon...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-1285 DESCRIPTION: An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. django.utils.text.Truncator.chars and...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-73646 DESCRIPTION: PostCSS...

Security Bulletin: Impacted IBM optim 1.0.0, 1.1.0 (optim-spark) by vulnerability in github.com/slackhq/nebula package

Summary Impacted IBM optim 1.0.0, 1.1.0 optim-spark by vulnerability in github.com/slackhq/nebula package. IBM optim 1.2.0 resolves this vulnerability by upgrading the package from vulnerable version Vulnerability Details CVEID:CVE-2026-25793 DESCRIPTION: Nebula is a scalable overlay networking...