Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-19622: IBM Planning Analytics may let attackers gain unauthorized access

CVE-2026-19622 · published 3 days ago

Summary

Versions 2.0 and 2.1 of IBM Planning Analytics could allow a remote user to skip the login process and obtain higher privileges because the system does not correctly check certain internal requests. This could let an attacker view or change data they should not be able to. Apply the vendor's security update as soon as possible and verify that all systems are running the patched versions.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	planning analytics	2.0
ibm	planning_analytics	2.0 2.1 `cpe:2.3:a:ibm:planning_analytics:2.0:::::::*`

Original advisory text

IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.

References

https://www.ibm.com/support/pages/node/7291604 Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-288Authentication Bypass Using Alternate Path

Timeline

Published12 Oct 2026

Updated15 Oct 2026

First seen12 Oct 2026

Sources

CVE-2026-19622 · NVD

CVE-2026-19622 · MITRE

Track software like this

Free during beta