Description
IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.
Published: 2026-11-08
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized actions due to client‑side enforcement of server‑side security mechanisms
Action: Patch
AI Analysis

Impact

IBM Process Mining versions 2.0.0 through 2.2.1 contain a flaw where client‑side enforcement of server‑side security permissions is absent, allowing an authenticated user to perform actions that should be restricted. The weakness is classified as CWE‑602 and could enable privilege escalation or unauthorized data manipulation for users who possess valid credentials.

Affected Systems

The vulnerability affects IBM Process Mining On‑Premise deployments running any release from version 2.0.0 up to and including 2.2.1. The affected products are listed under the IBM:Process Mining vendor/product in the CNA data.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate severity impact. Because the EPSS score is not available, the exact likelihood of exploitation is unknown, but the vulnerability requires an authenticated user, limiting its exposure to internal or compromised accounts. The issue is not listed in the CISA KEV catalog, suggesting that there are currently no known large‑scale exploitations. The official remediation is an interim fix (2.2.1 IF001) delivered via IBM Support, so applying that patch effectively removes the risk.

Generated by OpenCVE AI on November 8, 2026 at 18:53 UTC.

Remediation

Vendor Solution

Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM Process Mining OCP2.0.0 - 2.2.1 IBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 IF001 Upgrade to version 2.2.1 IF001 https://www.ibm.com/support/pages/readme-ibm-process-mining-221-if001 uniIBM Process Mining On-Prem2.0.0 - 2.2.1IBM strongly suggests that you address the vulnerabilities now for all affected products/versions listed above by installing 2.2.1 Steps 1. Go to IBM Support Portal Navigate to https://ibm.com/mysupport and sign in with your IBMid before proceeding. 2. Open a case * Click "Open a case" from the support portal. * Select IBM Process Mining as the product. * Fill in the case details, referencing the published security advisory: https://www.ibm.com/support/pages/node/7294875 * Request the delivery of IBM Process Mining 2.2.1 IF001, which addresses the documented vulnerabilities. 3. Obtain the fix The interim fix will be delivered directly through your support case once it has been opened.

OpenCVE Recommended Actions

  • Open an IBM Support case to request the 2.2.1 IF001 interim fix for Process Mining
  • Install the interim fix on all affected Process Mining instances, following the vendor’s instructions
  • Schedule the deployment during a maintenance window to minimize service disruption

Generated by OpenCVE AI on November 8, 2026 at 18:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 17:15:00 +0000

Type Values Removed Values Added
Description IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms.
Title Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026
First Time appeared Ibm
Ibm process Mining
Weaknesses CWE-602
CPEs cpe:2.3:a:ibm:process_mining:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:process_mining:2.2.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm process Mining
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Ibm Process Mining
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-08T16:57:33.479Z

Reserved: 2026-10-19T15:49:50.662Z

Link: CVE-2026-112369

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-08T17:16:36.277

Modified: 2026-11-08T17:16:36.387

Link: CVE-2026-112369

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T19:00:14Z

Weaknesses
  • CWE-602

    Client-Side Enforcement of Server-Side Security