CVE-2026-17466

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17466", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-07-25T20:16:15.375Z", "datePublished": "2026-11-08T17:51:39.935Z", "dateUpdated": "2026-11-09T20:07:24.785Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T17:51:39.935Z"}, "title": "IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Optim", "versions": [{"status": "affected", "version": "1.0.0"}, {"status": "affected", "version": "1.1.0"}, {"status": "affected", "version": "1.2.0"}], "cpes": ["cpe:2.3:a:ibm:optim:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:optim:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:optim:1.2.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7289719", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\n\n\nMove to IBM Optim Test Data Management 2.0.0 IBM Optim Test Data Management 2.0.0 resolves all three vulnerabilities.\n\n\n\nFile Path Traversal (ID: 218782) \u2014 The application now validates that file paths requested by users stay within the permitted directory. Any request attempting to access files outside that boundary is rejected.\n\n\n\nNo Rate Limit (ID: 218776) \u2014 The application now enforces request rate limits per user on protected endpoints and per IP address on login endpoints. Requests that exceed the limit are blocked until the rate drops back within bounds.\n\n\n\nWeak Password Policy (ID: 218648) \u2014 Default accounts and passwords have been removed. A unique administrator password is now generated automatically during installation.\n\n\nAvailable from https://www.ibm.com/software/passportadvantage/pao-customer", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly recommends addressing the vulnerability now.</p><p>Move to IBM Optim Test Data Management 2.0.0 IBM Optim Test Data Management 2.0.0 resolves all three vulnerabilities.</p><p>File Path Traversal (ID: 218782) \u2014 The application now validates that file paths requested by users stay within the permitted directory. Any request attempting to access files outside that boundary is rejected.</p><p>No Rate Limit (ID: 218776) \u2014 The application now enforces request rate limits per user on protected endpoints and per IP address on login endpoints. Requests that exceed the limit are blocked until the rate drops back within bounds.</p><p>Weak Password Policy (ID: 218648) \u2014 Default accounts and passwords have been removed. A unique administrator password is now generated automatically during installation.<br/><br/><br/>Available from <a href=\"https://www.ibm.com/software/passportadvantage/pao-customer\" rel=\"nofollow\">https://www.ibm.com/software/passportadvantage/pao-customer</a></p>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T20:07:16.718265Z", "id": "CVE-2026-17466", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T20:07:24.785Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-17466", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T20:07:16.718265Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T20:07:20.926Z"}}], "cna": {"title": "IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:optim:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:optim:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:optim:1.2.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Optim", "versions": [{"status": "affected", "version": "1.0.0"}, {"status": "affected", "version": "1.1.0"}, {"status": "affected", "version": "1.2.0"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\n\n\nMove to IBM Optim Test Data Management 2.0.0 IBM Optim Test Data Management 2.0.0 resolves all three vulnerabilities.\n\n\n\nFile Path Traversal (ID: 218782) \u2014 The application now validates that file paths requested by users stay within the permitted directory. Any request attempting to access files outside that boundary is rejected.\n\n\n\nNo Rate Limit (ID: 218776) \u2014 The application now enforces request rate limits per user on protected endpoints and per IP address on login endpoints. Requests that exceed the limit are blocked until the rate drops back within bounds.\n\n\n\nWeak Password Policy (ID: 218648) \u2014 Default accounts and passwords have been removed. A unique administrator password is now generated automatically during installation.\n\n\nAvailable from https://www.ibm.com/software/passportadvantage/pao-customer", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability now.</p><p>Move to IBM Optim Test Data Management 2.0.0 IBM Optim Test Data Management 2.0.0 resolves all three vulnerabilities.</p><p>File Path Traversal (ID: 218782) \u2014 The application now validates that file paths requested by users stay within the permitted directory. Any request attempting to access files outside that boundary is rejected.</p><p>No Rate Limit (ID: 218776) \u2014 The application now enforces request rate limits per user on protected endpoints and per IP address on login endpoints. Requests that exceed the limit are blocked until the rate drops back within bounds.</p><p>Weak Password Policy (ID: 218648) \u2014 Default accounts and passwords have been removed. A unique administrator password is now generated automatically during installation.<br/><br/><br/>Available from <a href=\"https://www.ibm.com/software/passportadvantage/pao-customer\" rel=\"nofollow\">https://www.ibm.com/software/passportadvantage/pao-customer</a></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7289719", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T17:51:39.935Z"}}}, "cveMetadata": {"cveId": "CVE-2026-17466", "state": "PUBLISHED", "dateUpdated": "2026-11-09T20:07:24.785Z", "dateReserved": "2026-07-25T20:16:15.375Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-11-08T17:51:39.935Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:optim:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:optim:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:optim:1.2.0:*:*:*:*:*:*:*"], "product": "Optim", "vendor": "IBM", "versions": [{"status": "affected", "version": "1.0.0"}, {"status": "affected", "version": "1.1.0"}, {"status": "affected", "version": "1.2.0"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal."}], "id": "CVE-2026-17466", "lastModified": "2026-11-09T20:18:14.343", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.3, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17466", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T20:07:16.718265Z", "version": "2.0.3"}}]}, "published": "2026-11-08T18:17:03.303", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7289719"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Optim", "source": "cna", "vendor": "IBM"}, "product": "optim", "vendor": "ibm"}], "created": "2026-11-08T19:30:12.961601+00:00", "updated": "2026-11-09T16:38:00.445323+00:00", "vendors": ["ibm", "ibm$PRODUCT$optim"]}