CVE-2026-0977

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0977", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-01-15T06:53:02.974Z", "datePublished": "2026-03-13T20:11:00.825Z", "dateUpdated": "2026-03-16T20:10:20.798Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-13T20:11:00.825Z"}, "title": "IBM CICS Transaction Gateway for Multiplatforms Information Disclosure", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-284", "description": "CWE-284", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "CICS Transaction Gateway for Multiplatforms", "versions": [{"status": "affected", "version": "9.3"}, {"status": "affected", "version": "10.1"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:ibm:cics_transaction_gateway:9.3:*:*:*:*:multiplatforms:*:*", "cpe:2.3:a:ibm:cics_transaction_gateway:10.1:*:*:*:*:multiplatforms:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM CICS Transaction Gateway for Multiplatforms 9.3 and 10.1 could allow a user to transfer or view files due to improper access controls.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "IBM CICS Transaction Gateway for Multiplatforms 9.3 and 10.1 could allow a user to transfer or view files due to improper access controls.&nbsp;"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7263518", "tags": ["patch", "vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.1, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}, "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerabilities now by configuring proper egress/ingress policies at either the POD or HOST level.\u00a0 More details as to how to do this are described in the following CICS Transaction Gateway for Multiplatforms documentation.\n\nProductVRMFRemediation/First FixCICS Transaction Gateway for Multiplatforms9.3Refer to this\u00a0 documentation https://www.ibm.com/docs/en/cics-tg-multi/9.3.0 CICS Transaction Gateway for Multiplatforms10.1Refer to this\u00a0 documentation https://www.ibm.com/docs/en/cics-tg-multi/10.1.0", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly recommends addressing the vulnerabilities now by configuring proper egress/ingress policies at either the POD or HOST level.&nbsp; More details as to how to do this are described in the following CICS Transaction Gateway for Multiplatforms documentation.</p><div><table><tbody><tr><td>Product</td><td>VRMF</td><td>Remediation/First Fix</td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>9.3</td><td>Refer to this&nbsp;<a title=\"https://www.ibm.com/docs/en/cics-tg-multi/9.3.0?topic=security-network-policies-cics-tg-in-containers\" href=\"https://www.ibm.com/docs/en/cics-tg-multi/9.3.0?topic=security-network-policies-cics-tg-in-containers\" rel=\"nofollow\">documentation</a></td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>10.1</td><td><p>Refer to this&nbsp;<a title=\"https://www.ibm.com/docs/en/cics-tg-multi/10.1.0?topic=security-network-policies-cics-tg-in-containers\" href=\"https://www.ibm.com/docs/en/cics-tg-multi/10.1.0?topic=security-network-policies-cics-tg-in-containers\" rel=\"nofollow\">documentation</a></p></td></tr></tbody></table></div><br>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T20:10:07.509831Z", "id": "CVE-2026-0977", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:10:20.798Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0977", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T20:10:07.509831Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:10:16.092Z"}}], "cna": {"title": "IBM CICS Transaction Gateway for Multiplatforms Information Disclosure", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:cics_transaction_gateway:9.3:*:*:*:*:multiplatforms:*:*", "cpe:2.3:a:ibm:cics_transaction_gateway:10.1:*:*:*:*:multiplatforms:*:*"], "vendor": "IBM", "product": "CICS Transaction Gateway for Multiplatforms", "versions": [{"status": "affected", "version": "9.3"}, {"status": "affected", "version": "10.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerabilities now by configuring proper egress/ingress policies at either the POD or HOST level.\u00a0 More details as to how to do this are described in the following CICS Transaction Gateway for Multiplatforms documentation.\n\nProductVRMFRemediation/First FixCICS Transaction Gateway for Multiplatforms9.3Refer to this\u00a0 documentation https://www.ibm.com/docs/en/cics-tg-multi/9.3.0 CICS Transaction Gateway for Multiplatforms10.1Refer to this\u00a0 documentation https://www.ibm.com/docs/en/cics-tg-multi/10.1.0", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerabilities now by configuring proper egress/ingress policies at either the POD or HOST level.&nbsp; More details as to how to do this are described in the following CICS Transaction Gateway for Multiplatforms documentation.</p><div><table><tbody><tr><td>Product</td><td>VRMF</td><td>Remediation/First Fix</td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>9.3</td><td>Refer to this&nbsp;<a title=\"https://www.ibm.com/docs/en/cics-tg-multi/9.3.0?topic=security-network-policies-cics-tg-in-containers\" href=\"https://www.ibm.com/docs/en/cics-tg-multi/9.3.0?topic=security-network-policies-cics-tg-in-containers\" rel=\"nofollow\">documentation</a></td></tr><tr><td>CICS Transaction Gateway for Multiplatforms</td><td>10.1</td><td><p>Refer to this&nbsp;<a title=\"https://www.ibm.com/docs/en/cics-tg-multi/10.1.0?topic=security-network-policies-cics-tg-in-containers\" href=\"https://www.ibm.com/docs/en/cics-tg-multi/10.1.0?topic=security-network-policies-cics-tg-in-containers\" rel=\"nofollow\">documentation</a></p></td></tr></tbody></table></div><br>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7263518", "tags": ["patch", "vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM CICS Transaction Gateway for Multiplatforms 9.3 and 10.1 could allow a user to transfer or view files due to improper access controls.", "supportingMedia": [{"type": "text/html", "value": "IBM CICS Transaction Gateway for Multiplatforms 9.3 and 10.1 could allow a user to transfer or view files due to improper access controls.&nbsp;", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-03-13T20:11:00.825Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0977", "state": "PUBLISHED", "dateUpdated": "2026-03-16T20:10:20.798Z", "dateReserved": "2026-01-15T06:53:02.974Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-03-13T20:11:00.825Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:cics_transaction_gateway:9.3:*:*:*:*:multiplatforms:*:*", "cpe:2.3:a:ibm:cics_transaction_gateway:10.1:*:*:*:*:multiplatforms:*:*"], "defaultStatus": "unaffected", "product": "CICS Transaction Gateway for Multiplatforms", "vendor": "IBM", "versions": [{"status": "affected", "version": "9.3"}, {"status": "affected", "version": "10.1"}]}], "source": "psirt@us.ibm.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cics_transaction_gateway:9.3:*:*:*:*:multiplatforms:*:*", "matchCriteriaId": "7E9F94E4-76EC-4324-A98F-61BFAD7CFE4C", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:cics_transaction_gateway:10.1:*:*:*:*:multiplatforms:*:*", "matchCriteriaId": "D9FA00A6-68E7-4985-B915-DF83924D338F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM CICS Transaction Gateway for Multiplatforms 9.3 and 10.1 could allow a user to transfer or view files due to improper access controls."}, {"lang": "es", "value": "IBM CICS Transaction Gateway para multiplataformas 9.3 y 10.1 podr\u00eda permitir a un usuario transferir o ver archivos debido a controles de acceso inadecuados."}], "id": "CVE-2026-0977", "lastModified": "2026-06-17T10:11:43.330", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 2.5, "source": "psirt@us.ibm.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0977", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T20:10:07.509831Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:18:07.810", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "https://www.ibm.com/support/pages/node/7263518"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "psirt@us.ibm.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "10.1"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "CICS Transaction Gateway for Multiplatforms", "source": "cna", "vendor": "IBM"}, "product": "cics_transaction_gateway", "vendor": "ibm"}], "analysis": {"en": {"generated_at": "2026-04-02T15:52:54.935979+00:00", "value": {"mitigation_remediation": ["Apply the IBM\u2011recommended configuration changes to enforce proper egress/ingress policies at the pod or host level as documented by IBM.", "Verify that file transfer and view functionalities are restricted to authorized users and that permission checks are enforced.", "Monitor system logs for unauthorized file access attempts and investigate anomalies promptly."], "summary": {"action": "Configure Policies", "impact": "Information disclosure due to improper access controls"}, "threat_synthesis": {"affected_systems": "IBM CICS Transaction Gateway for Multiplatforms versions 9.3 and 10.1 deployed in multiplatform environments are affected. The issue applies to installations referenced by the CPE strings for 9.3 and 10.1.", "description_and_impact": "The vulnerability arises from improper access controls in IBM CICS Transaction Gateway for Multiplatforms, allowing users to transfer or view files they should not have access to. This flaw results in the unauthorized disclosure of information and is aligned with CWE\u2011284 (Improper Restriction of Operations within the Bounds of a Function). The potential impact is the exposure of sensitive data stored or transmitted through the gateway, affecting confidentiality.", "risk_and_exploitability": "The CVSS score is 5.1 (medium), and the EPSS score is under 1%, indicating a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack could be carried out by authenticated users who have access to the gateway\u2019s file operations, or potentially by any user in the same environment if additional privilege escalations occur. Proper ingress/egress policies at the pod or host level help mitigate the risk."}}}}, "created": "2026-03-16T09:23:57.170943+00:00", "updated": "2026-04-02T20:23:48.222192+00:00", "vendors": ["ibm", "ibm$PRODUCT$cics_transaction_gateway"]}