CVE-2026-18658 - Vulnerability Details - OpenCVE

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	Operational Decision Manager

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7286196

History

Fri, 04 Sep 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
Title		IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed
First Time appeared		Ibm Ibm operational Decision Manager
Weaknesses		CWE-89
CPEs		cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:::::::* cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:::::::* cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:::::::* cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:::::::* cpe:2.3:a:ibm:operational_decision_manager:9.5.0.0:::::::* cpe:2.3:a:ibm:operational_decision_manager:9.5.0.1:::::::* cpe:2.3:a:ibm:operational_decision_manager:9.6.0.0:::::::*
Vendors & Products		Ibm Ibm operational Decision Manager
References		https://www.ibm.com/support/pages/node/7286196
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2026-09-04T16:10:18.743Z

Updated: 2026-09-04T16:10:18.743Z

Reserved: 2026-08-03T13:15:01.738Z

Link: CVE-2026-18658

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-09-04T16:17:21.133

Modified: 2026-09-08T14:17:08.940

Link: CVE-2026-18658

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18658", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-08-03T13:15:01.738Z", "datePublished": "2026-09-04T16:10:18.743Z", "dateUpdated": "2026-09-04T16:10:18.743Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-09-04T16:10:18.743Z"}, "title": "IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Operational Decision Manager", "versions": [{"status": "affected", "version": "9.6.0.0"}, {"status": "affected", "version": "9.5.0.0"}, {"status": "affected", "version": "8.11.1.0"}, {"status": "affected", "version": "8.11.0.1"}, {"status": "affected", "version": "8.12.0.1"}, {"status": "affected", "version": "9.5.0.1"}, {"status": "affected", "version": "9.0.0.1"}], "cpes": ["cpe:2.3:a:ibm:operational_decision_manager:9.6.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7286196", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by upgrading.\n\n\n\nIBM Operational Decision Manager V8.11.0.1\nInterim fix 060 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7283100 .\n\n\n\nIBM Operational Decision Manager V8.11.1:\nInterim fix 059 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7282614 .\n\n\n\nIBM Operational Decision Manager V8.12.0.1:\nInterim fix 043 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7282466 .\n\n\n\nIBM Operational Decision Manager V9.0.0.1:\nInterim fix 029 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7282488 .\n\n\n\n\u00a0IBM Operational Decision Manager V9.5.0.1:\nInterim fix 017 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7233740 .\n\n\n\n\u00a0IBM Operational Decision Manager V9.6.0.0:\nInterim fix 004 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7273804 .", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly recommends addressing the vulnerability now by upgrading.</p><p>IBM Operational Decision Manager V8.11.0.1<br/>Interim fix 060 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7283100\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V8.11.1:<br/>Interim fix 059 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7282614\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V8.12.0.1:<br/>Interim fix 043 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7282466\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V9.0.0.1:<br/>Interim fix 029 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7282488\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>\u00a0IBM Operational Decision Manager V9.5.0.1:<br/>Interim fix 017 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7233740\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>\u00a0IBM Operational Decision Manager V9.6.0.0:<br/>Interim fix 004 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7273804\" rel=\"nofollow noopener noreferrer\">download document</a>.</p>"}]}]}}}