IBM vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited IBM flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-9198 IBM Langflow Code InjectionExploited since Aug 4, 2026 · CVSS 9.8
• CVE-2022-47986 IBM Aspera Faspex Code ExecutionExploited since Feb 21, 2023 · ransomware · CVSS 9.8
• CVE-2013-3993 IBM InfoSphere BigInsights Invalid InputExploited since May 25, 2022 · ransomware · CVSS 6.5
• CVE-2015-7450 IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.Exploited since Jan 10, 2022 · CVSS 9.8
• CVE-2020-4428 IBM Data Risk Manager Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 9.1
• CVE-2020-4427 IBM Data Risk Manager Security BypassExploited since Nov 3, 2021 · CVSS 9.8
• CVE-2019-4716 IBM Planning Analytics Remote Code ExecutionExploited since Nov 3, 2021 · CVSS 9.8
• CVE-2020-4430 IBM Data Risk Manager Directory TraversalExploited since Nov 3, 2021 · CVSS 4.3

Latest high and critical flaws

• CVE-2026-93888 IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient High 7.8 · Oct 20, 2026
• CVE-2026-93442 IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service orHigh 8.2 · Oct 20, 2026
• CVE-2026-93441 IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.High 8.6 · Oct 20, 2026
• CVE-2026-92559 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.Critical 9.8 · Oct 20, 2026
• CVE-2026-82891 IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.High 8.1 · Oct 20, 2026
• CVE-2026-81212 IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key.Critical 10 · Oct 20, 2026
• CVE-2026-76587 IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking.High 8.8 · Oct 20, 2026
• CVE-2026-109126 IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges duHigh 8.8 · Oct 19, 2026
• CVE-2026-107400 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication.High 8.8 · Oct 19, 2026
• CVE-2026-107366 IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification.High 8.3 · Oct 19, 2026
• CVE-2026-105453 IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to impropeHigh 8.4 · Oct 19, 2026
• CVE-2026-6719 IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.High 7.5 · Oct 19, 2026
• CVE-2026-3295 IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting.High 7.4 · Oct 19, 2026
• CVE-2026-12665 IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished nameHigh 8.1 · Oct 19, 2026
• CVE-2026-12148 IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserializatioHigh 7.5 · Oct 19, 2026
• CVE-2026-10743 IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.High 8.8 · Oct 19, 2026
• CVE-2026-10574 IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQHigh 8.8 · Oct 19, 2026
• CVE-2026-10572 IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQHigh 8.8 · Oct 19, 2026
• CVE-2026-102917 IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege.High 7.8 · Oct 16, 2026
• CVE-2026-95695 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorizatHigh 7.4 · Oct 13, 2026
• CVE-2026-93909 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is enableCritical 9.1 · Oct 13, 2026
• CVE-2026-93905 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch joHigh 8.2 · Oct 13, 2026
• CVE-2026-93895 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRCritical 9.1 · Oct 13, 2026
• CVE-2026-105443 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.High 8.2 · Oct 13, 2026
• CVE-2026-105442 IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker toHigh 7.5 · Oct 13, 2026