Description
IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
Published: 2026-11-08
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

IBM SevOne Network Performance Management versions 7.0.0 through 8.2.2 contain a flaw that allows a remote attacker to trigger a denial of service by consuming uncontrolled system resources. The weakness, identified as Uncontrolled Resource Consumption (CWE-400), means that carefully crafted requests can exhaust memory, CPU, or other critical resources, causing the application to become unresponsive or crash, thus interrupting normal network performance monitoring operations.

Affected Systems

The vulnerability affects all IBM SevOne Network Performance Management products, including the Diagnostic Interface, Network Management System, and SD‑WAN modules, specifically versions 7.0.0 up to 8.2.2. The latest supported releases provide fixes: version 8.2.4 for the Diagnostic Interface and version 8.2.3 for the Network Management System and SD‑WAN.

Risk and Exploitability

The CVSS score of 7.5 indicates a high impact in terms of availability, while the EPSS is not available and the issue is not listed in the CISA KEV catalog. Attacks would likely require remote network access to the SevOne services and can be carried out without authentication, making the vulnerability exploitable in a wide range of environments. Until the software is updated, the risk remains significant for organizations relying on this monitoring solution.

Generated by OpenCVE AI on November 8, 2026 at 21:51 UTC.

Remediation

Vendor Solution

IBM SevOne Network Performance Management has previously remediated the vulnerabilities listed in this bulletin through product maintenance and updates.  This security bulletin is being published as a historical reference to align with current security disclosure practices and does not contain new findings. IBM strongly recommends addressing these vulnerabilities now by upgrading. Please refer to the instructions below for installation steps for your specific version. Product(s) Latest Version(s)  Remediation/Fix/InstructionsIBM SevOne Network Performance Management (DI)8.2.4 Download https://www.ibm.com/support/fixcentral/quickorder and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0 IBM SevOne Network Performance Management (NMS)8.2.3 Download https://www.ibm.com/support/fixcentral/swg/selectFixes and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0 IBM SevOne Network Performance Management (SD-WAN)8.2.3 Download https://www.ibm.com/support/fixcentral/swg/selectFixes and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0

OpenCVE Recommended Actions

  • Upgrade IBM SevOne Network Performance Management to the latest supported version (8.2.4 for DI or 8.2.3 for NMS and SD‑WAN) following the vendor download and release‑notes instructions.
  • If an upgrade cannot be performed immediately, isolate or restrict access to the SevOne services and consider implementing rate limiting or other resource usage controls to mitigate potential denial‑of‑service attacks until the fix is applied.
  • In addition, monitor network traffic and application logs for signs of excessive resource consumption and enforce firewall or API gateway rules to limit requests per second to SevOne endpoints during the interim period until the patch is applied.

Generated by OpenCVE AI on November 8, 2026 at 21:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 20:00:00 +0000

Type Values Removed Values Added
Description IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
Title Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management
First Time appeared Ibm
Ibm sevone Network Performance Management
Weaknesses CWE-400
CPEs cpe:2.3:a:ibm:sevone_network_performance_management:7.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sevone_network_performance_management:8.2.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm sevone Network Performance Management
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ibm Sevone Network Performance Management
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-08T19:44:23.101Z

Reserved: 2026-09-22T18:37:41.901Z

Link: CVE-2026-96146

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-08T20:17:25.193

Modified: 2026-11-08T20:17:25.317

Link: CVE-2026-96146

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T22:00:17Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption