Description
IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Published: 2026-10-12
Score: 6.4 Medium
EPSS: n/a
KEV: No
Impact: Stored cross‑site scripting enabling credential disclosure
Action: Patch Now
AI Analysis

Impact

IBM Planning Analytics 2.0 and 2.1 contain a stored cross‑site scripting flaw (CWE‑79) that allows any authenticated user to embed arbitrary JavaScript into the web interface. Executed scripts run with the privileges of the authenticated session and can exfiltrate credentials or other data visible to the user, disrupting intended functionality and compromising confidentiality.

Affected Systems

The affected product is IBM Planning Analytics Local. Versions 2.0 and 2.1.0 through 2.1.23 are vulnerable; version 2.1.24 and later contain the fix. The vulnerability is present on all components that render user supplied data in the web UI.

Risk and Exploitability

The CVSS score of 6.4 indicates a medium severity vulnerability. Because the flaw requires an authenticated user, the exploitation vector is limited to users with access to the Planning Analytics Local interface. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting the likelihood of a widespread, publicly known exploitation is currently low. However, any privileged or administrator accounts that have the ability to create or edit data could be used to inject malicious script, making the risk significant for organizations with many such users.

Generated by OpenCVE AI on October 13, 2026 at 01:00 UTC.

Remediation

Vendor Solution

It is strongly recommended that you apply the most recent security updates:  Affected Product(s)Version(s)FixIBM Planning Analytics Local2.1.0 - 2.1.23 IBM Planning Analytics Local 2.1.24 is now available for download from Fix Central https://w3.ibm.com/w3publisher/capa-release-announcements/2026-releases/pa-2026-releases IBM Planning Analytics Cloud environment has been remediated.

OpenCVE Recommended Actions

  • Download and install IBM Planning Analytics Local version 2.1.24 or later from IBM Fix Central and apply the patch to all affected servers.
  • Ensure that only users who truly need permission to inject content are granted write access to the web‑UI elements that accept user data.
  • Implement or enforce a content security policy that restricts inline script execution for future deployments.
  • Monitor user activity logs for abnormal script injection attempts and review the web UI for unapproved JavaScript.

Generated by OpenCVE AI on October 13, 2026 at 01:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Title IBM Planning Analytics Local is affected by security vulnerabilities
First Time appeared Ibm
Ibm planning Analytics
Weaknesses CWE-79
CPEs cpe:2.3:a:ibm:planning_analytics:2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:planning_analytics:2.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm planning Analytics
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Ibm Planning Analytics
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-12T22:40:30.366Z

Reserved: 2026-07-31T20:51:03.198Z

Link: CVE-2026-18541

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T23:17:36.710

Modified: 2026-10-12T23:17:36.710

Link: CVE-2026-18541

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T01:00:15Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')