Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-18658

IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed

CVSS 3.1 9.8 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-18658

Published

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-18658

Published

Operational Decision Manager

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "IBM",
                    "product": "Operational Decision Manager",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "9.6.0.0"
                        },
                        {
                            "status": "affected",
                            "version": "9.5.0.0"
                        },
                        {
                            "status": "affected",
                            "version": "8.11.1.0"
                        },
                        {
                            "status": "affected",
                            "version": "8.11.0.1"
                        },
                        {
                            "status": "affected",
                            "version": "8.12.0.1"
                        },
                        {
                            "status": "affected",
                            "version": "9.5.0.1"
                        },
                        {
                            "status": "affected",
                            "version": "9.0.0.1"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:operational_decision_manager:9.6.0.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:operational_decision_manager:9.5.0.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:operational_decision_manager:9.5.0.1:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON