CVE-2026-18658 PUBLISHED

IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed

Assigner: ibm
Reserved: 03.08.2026 Published: 04.09.2026 Updated: 04.09.2026

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor IBM
Product Operational Decision Manager
Versions
  • Version 9.6.0.0 is affected
  • Version 9.5.0.0 is affected
  • Version 8.11.1.0 is affected
  • Version 8.11.0.1 is affected
  • Version 8.12.0.1 is affected
  • Version 9.5.0.1 is affected
  • Version 9.0.0.1 is affected

Solutions

IBM strongly recommends addressing the vulnerability now by upgrading.

IBM Operational Decision Manager V8.11.0.1 Interim fix 060 is available, see  download document https://www.ibm.com/support/pages/node/7283100 .

IBM Operational Decision Manager V8.11.1: Interim fix 059 is available, see  download document https://www.ibm.com/support/pages/node/7282614 .

IBM Operational Decision Manager V8.12.0.1: Interim fix 043 is available, see  download document https://www.ibm.com/support/pages/node/7282466 .

IBM Operational Decision Manager V9.0.0.1: Interim fix 029 is available, see  download document https://www.ibm.com/support/pages/node/7282488 .

IBM Operational Decision Manager V9.5.0.1: Interim fix 017 is available, see  download document https://www.ibm.com/support/pages/node/7233740 .

IBM Operational Decision Manager V9.6.0.0: Interim fix 004 is available, see  download document https://www.ibm.com/support/pages/node/7273804 .

References

Problem Types

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE