Stored Cross-Site Scripting in IBM Planning Analytics
CVE-2026-18541

6.4MEDIUM

Key Information:

Vendor

IBM
Status
Planning Analytics
Vendor
CVE Published:
12 October 2026

What is CVE-2026-18541?

IBM Planning Analytics versions 2.0 and 2.1 are susceptible to a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code into the Web UI. This manipulation can compromise the intended functionality and potentially result in the disclosure of sensitive credentials within a trusted session. Ensuring security against this vulnerability is critical for maintaining the integrity and confidentiality of user sessions.

Affected Version(s)

Planning Analytics 2.0

Planning Analytics 2.1

References

https://www.ibm.com/support/pages/node/7291604
vendor-advisorypatch

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.