CVE-2026-16713 PUBLISHED

IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

Assigner: ibm
Reserved: 23.07.2026 Published: 13.08.2026 Updated: 13.08.2026

IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 4.3

Attack Vector	Adjacent Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	Documentation Offline
Versions	affected from 1.0.0 to 1.4.1 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now.

Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM Documentation Offline1.0.0 - 1.4.1Download and install latest release (1.5.1) https://www.ibm.com/docs/en/offline

References

https://www.ibm.com/support/pages/node/7283484

Problem Types

CWE-1327 Binding to an Unrestricted IP Address CWE