CVE-2026-17468 PUBLISHED

IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

Assigner: ibm
Reserved: 25.07.2026 Published: 13.08.2026 Updated: 14.08.2026

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	Low
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	IBM
Product	Documentation Offline
Versions	affected from 1.0.0 to 1.4.1 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM Documentation Offline1.0.0 - 1.4.1Download and install latest release (1.5.1)

References

https://www.ibm.com/support/pages/node/7283484

Problem Types

CWE-321 Use of Hard-coded Cryptographic Key CWE