Description
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
Published: 2026-09-04
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via SQL Injection
Action: Immediate Patch
AI Analysis

Impact

IBM Operational Decision Manager is vulnerable to unauthenticated SQL injection that enables an attacker to execute arbitrary SQL statements and write a web shell to the application’s web root, leading to remote code execution.

Affected Systems

IBM Operational Decision Manager versions 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, and 9.6.0.0 are affected. The vulnerability can be triggered by unauthenticated requests that provide unvalidated input. Based on the description, it is inferred that these versions expose a publicly accessible interface that allows the injection payload to be transmitted.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is not available, but an unauthenticated attacker can reach the vulnerable code directly via web requests, making exploitation highly likely if the application is accessible from the internet. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on September 4, 2026 at 19:09 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading. IBM Operational Decision Manager V8.11.0.1 Interim fix 060 is available, see  download document https://www.ibm.com/support/pages/node/7283100 . IBM Operational Decision Manager V8.11.1: Interim fix 059 is available, see  download document https://www.ibm.com/support/pages/node/7282614 . IBM Operational Decision Manager V8.12.0.1: Interim fix 043 is available, see  download document https://www.ibm.com/support/pages/node/7282466 . IBM Operational Decision Manager V9.0.0.1: Interim fix 029 is available, see  download document https://www.ibm.com/support/pages/node/7282488 .  IBM Operational Decision Manager V9.5.0.1: Interim fix 017 is available, see  download document https://www.ibm.com/support/pages/node/7233740 .  IBM Operational Decision Manager V9.6.0.0: Interim fix 004 is available, see  download document https://www.ibm.com/support/pages/node/7273804 .

OpenCVE Recommended Actions

  • Apply the vendor‑provided interim fix for your installation: use fix 060 for 8.11.0.1, fix 059 for 8.11.1.0, fix 043 for 8.12.0.1, fix 029 for 9.0.0.1, fix 017 for 9.5.0.0 and 9.5.0.1, and fix 004 for 9.6.0.0.
  • Disable or tightly restrict write permissions to the application’s web root directory and configure the web server to reject unauthorized file uploads or writes. This prevents the attacker from persisting a web shell once the injection succeeds.
  • Enforce database‑level least privilege by ensuring the application database accounts have only the permissions necessary for normal operations, and switch existing queries to use parameterized statements or stored procedures to eliminate the injection surface.

Generated by OpenCVE AI on September 4, 2026 at 19:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 10:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 04 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
Description IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
Title IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed
First Time appeared Ibm
Ibm operational Decision Manager
Weaknesses CWE-89
CPEs cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:9.5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:9.5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:operational_decision_manager:9.6.0.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm operational Decision Manager
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ibm Operational Decision Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-09-11T11:49:18.618Z

Reserved: 2026-08-03T13:15:01.738Z

Link: CVE-2026-18658

cve-icon Vulnrichment

Updated: 2026-09-10T20:57:06.211Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-04T16:17:21.133

Modified: 2026-09-10T21:17:23.990

Link: CVE-2026-18658

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-05T00:00:06Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')