SQL Injection Vulnerability in IBM Operational Decision Manager
CVE-2026-18658

9.8CRITICAL

Key Information:

Vendor

IBM
Status
Operational Decision Manager
Vendor
CVE Published:
4 September 2026

What is CVE-2026-18658?

IBM Operational Decision Manager versions 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 are susceptible to an SQL injection flaw. This vulnerability allows unauthenticated attackers to execute arbitrary SQL commands. By exploiting this weakness, attackers can leverage the database's functionality to deploy a web shell in the application's root directory, potentially leading to remote code execution. This poses significant risks to data integrity and system security.

Affected Version(s)

Operational Decision Manager 9.6.0.0

Operational Decision Manager 9.5.0.0

Operational Decision Manager 8.11.1.0

References

https://www.ibm.com/support/pages/node/7286196
vendor-advisorypatch

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.