CVE-2026-17466

IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities

Assigner: ibm
Reserved: 25.07.2026 Published: 08.11.2026 Updated: 08.11.2026

IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
CVSS Score: 9.1

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	IBM
Product	Optim
Versions	Version 1.0.0 is affected Version 1.1.0 is affected Version 1.2.0 is affected

Vendor

IBM

Product

Optim

Versions

Version 1.0.0 is affected
Version 1.1.0 is affected
Version 1.2.0 is affected

Solutions

IBM strongly recommends addressing the vulnerability now.

Move to IBM Optim Test Data Management 2.0.0 IBM Optim Test Data Management 2.0.0 resolves all three vulnerabilities.

File Path Traversal (ID: 218782) — The application now validates that file paths requested by users stay within the permitted directory. Any request attempting to access files outside that boundary is rejected.

No Rate Limit (ID: 218776) — The application now enforces request rate limits per user on protected endpoints and per IP address on login endpoints. Requests that exceed the limit are blocked until the rate drops back within bounds.

Weak Password Policy (ID: 218648) — Default accounts and passwords have been removed. A unique administrator password is now generated automatically during installation.

Available from https://www.ibm.com/software/passportadvantage/pao-customer

References

Problem Types