IBM Cyber Fraud 1.0.0 through 1.0.2 contains an unrestricted file upload that allows an attacker who can authenticate to the system to upload a file with a dangerous type, resulting in the execution of arbitrary code. The vulnerability is a classic example of CWE-434, where unfiltered file types lead to insecure handling and potential code execution. The impact on the affected system is full compromise of confidentiality, integrity, and availability, as any code could be run on the host with the privileges of the authenticated user.

The affected products are IBM Cyber Fraud software versions 1.0.0 and 1.0.2 running on the IBM platform. Users running any of these releases should verify their installation version and consider remediation if the vulnerable releases are present.

The reported CVSS score of 6.8 indicates a medium severity issue. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no known large‑scale exploit campaigns. Based on the description, the likely attack vector requires remote authenticated access to the application, after which the attacker can upload a malicious file to trigger arbitrary code execution.