Description
IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.
Published: 2026-10-20
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive data exposure through unencrypted cookie transmission
Action: Patch
AI Analysis

Impact

IBM Cyber Fraud 1.0.0 through 1.0.2 contains a missing secure attribute on certain cookies, allowing them to be sent over clear‑text connections. An attacker who can observe network traffic could capture these session cookies and potentially hijack user sessions or access sensitive data. The weakness is a reachable assertion flaw described by CWE‑617.

Affected Systems

The vulnerability affects IBM Cyber Fraud 1.0.0 and 1.0.2. IBM recommends upgrading to at least version 1.1.0, which includes the necessary secure cookie configuration. The affected products are listed under the IBM Cyber Fraud vendor and the specific CPE strings for versions 1.0.0 and 1.0.2.

Risk and Exploitability

The CVSS score of 3.7 indicates moderate impact, and the EPSS score of less than 1% shows a very low probability of exploitation at the time of this analysis. The vulnerability is not currently listed in the CISA KEV catalog. Attackers would need access to the network path between client and server to intercept traffic, which is a relatively low difficulty scenario for attackers already in the network vicinity.

Generated by OpenCVE AI on October 21, 2026 at 17:29 UTC.

Remediation

Vendor Solution

IBM strongly encourages customers to update their systems promptly. Please upgrade to at least version 1.1.0 according to the following instructions: https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud

OpenCVE Recommended Actions

  • Upgrade IBM Cyber Fraud to version 1.1.0 or later following IBM’s upgrade instructions
  • If an immediate upgrade is not feasible, configure the application to set the secure flag on all session cookies and avoid transmitting sensitive data over plain TCP
  • Enforce TLS everywhere by configuring network devices or application gateways to reject insecure HTTP traffic and require HTTPS for all client connections

Generated by OpenCVE AI on October 21, 2026 at 17:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Description IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.
Title IBM Cyber Fraud Reachable Assertion
First Time appeared Ibm
Ibm cyber Fraud
Weaknesses CWE-617
CPEs cpe:2.3:a:ibm:cyber_fraud:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cyber_fraud:1.0.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm cyber Fraud
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Ibm Cyber Fraud
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-21T15:35:58.392Z

Reserved: 2026-05-28T11:36:30.290Z

Link: CVE-2026-9825

cve-icon Vulnrichment

Updated: 2026-10-21T15:35:53.831Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:21:08.263

Modified: 2026-10-21T16:17:41.970

Link: CVE-2026-9825

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T13:00:06Z

Weaknesses