Description
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
Published: 2026-10-12
Score: 8.1 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack-based buffer overflow in IBM Planning Analytics 2.0 and 2.1 allows an authenticated attacker to execute arbitrary code. The flaw can be triggered remotely and grants full control over the affected system, potentially compromising confidentiality, integrity, and availability of data.

Affected Systems

IBM Planning Analytics Local 2.0 and 2.1 are affected. Versions 2.1.0 through 2.1.23 are vulnerable; version 2.1.24, released via IBM Fix Central, contains the fix. IBM has also remediated the Cloud environment.

Risk and Exploitability

The vulnerability has a CVSS score of 8.1, indicating high severity. EPSS is not available and it is not listed in CISA’s KEV catalog. The likely attack vector is a remote authenticated session, meaning an attacker who has valid credentials can exploit the flaw. Given the severity and potential for full system compromise, the risk is elevated even without current exploitation evidence.

Generated by OpenCVE AI on October 13, 2026 at 00:45 UTC.

Remediation

Vendor Solution

It is strongly recommended that you apply the most recent security updates: Affected Product(s)Version(s)FixIBM Planning Analytics Local2.1.0 - 2.1.23IBM Planning Analytics Local 2.1.24 is now available for download from Fix CentralIBM Planning Analytics Cloud environment has been remediated.

OpenCVE Recommended Actions

  • Apply the latest security update from IBM Fix Central, upgrading to Planning Analytics Local 2.1.24 or later.
  • Deploy the patch to all nodes in the environment to ensure the vulnerability is removed everywhere.
  • Enforce strict access controls so that only essential users have authentication privileges on the Planning Analytics platform, reducing the attack surface for authenticated attacks.

Generated by OpenCVE AI on October 13, 2026 at 00:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow.
Title IBM Planning Analytics Local is affected by security vulnerabilities
First Time appeared Ibm
Ibm planning Analytics
Weaknesses CWE-121
CPEs cpe:2.3:a:ibm:planning_analytics:2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:planning_analytics:2.1:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm planning Analytics
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Ibm Planning Analytics
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-12T22:40:03.709Z

Reserved: 2026-09-03T20:02:10.111Z

Link: CVE-2026-85457

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T23:17:45.167

Modified: 2026-10-12T23:17:45.167

Link: CVE-2026-85457

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T01:00:15Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow