CVE-2026-18658

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18658", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-08-03T13:15:01.738Z", "datePublished": "2026-09-04T16:10:18.743Z", "dateUpdated": "2026-09-11T11:49:18.618Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-09-11T11:49:18.618Z"}, "title": "IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Operational Decision Manager", "versions": [{"status": "affected", "version": "9.6.0.0"}, {"status": "affected", "version": "9.5.0.0"}, {"status": "affected", "version": "8.11.1.0"}, {"status": "affected", "version": "8.11.0.1"}, {"status": "affected", "version": "8.12.0.1"}, {"status": "affected", "version": "9.5.0.1"}, {"status": "affected", "version": "9.0.0.1"}], "cpes": ["cpe:2.3:a:ibm:operational_decision_manager:9.6.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7286196", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by upgrading.\n\n\n\nIBM Operational Decision Manager V8.11.0.1\nInterim fix 060 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7283100 .\n\n\n\nIBM Operational Decision Manager V8.11.1:\nInterim fix 059 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7282614 .\n\n\n\nIBM Operational Decision Manager V8.12.0.1:\nInterim fix 043 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7282466 .\n\n\n\nIBM Operational Decision Manager V9.0.0.1:\nInterim fix 029 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7282488 .\n\n\n\n\u00a0IBM Operational Decision Manager V9.5.0.1:\nInterim fix 017 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7233740 .\n\n\n\n\u00a0IBM Operational Decision Manager V9.6.0.0:\nInterim fix 004 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7273804 .", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly recommends addressing the vulnerability now by upgrading.</p><p>IBM Operational Decision Manager V8.11.0.1<br/>Interim fix 060 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7283100\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V8.11.1:<br/>Interim fix 059 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7282614\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V8.12.0.1:<br/>Interim fix 043 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7282466\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V9.0.0.1:<br/>Interim fix 029 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7282488\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>\u00a0IBM Operational Decision Manager V9.5.0.1:<br/>Interim fix 017 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7233740\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>\u00a0IBM Operational Decision Manager V9.6.0.0:<br/>Interim fix 004 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7273804\" rel=\"nofollow noopener noreferrer\">download document</a>.</p>"}]}], "credits": [{"lang": "en", "value": "Sonny of watchTowr (https://watchtowr.com/)", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18658", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-10T20:38:13.682174Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T21:00:34.810Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18658", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-10T20:38:13.682174Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T20:57:06.211Z"}}], "cna": {"title": "IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed", "credits": [{"lang": "en", "type": "finder", "value": "Sonny of watchTowr (https://watchtowr.com/)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:operational_decision_manager:9.6.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Operational Decision Manager", "versions": [{"status": "affected", "version": "9.6.0.0"}, {"status": "affected", "version": "9.5.0.0"}, {"status": "affected", "version": "8.11.1.0"}, {"status": "affected", "version": "8.11.0.1"}, {"status": "affected", "version": "8.12.0.1"}, {"status": "affected", "version": "9.5.0.1"}, {"status": "affected", "version": "9.0.0.1"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now by upgrading.\n\n\n\nIBM Operational Decision Manager V8.11.0.1\nInterim fix 060 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7283100 .\n\n\n\nIBM Operational Decision Manager V8.11.1:\nInterim fix 059 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7282614 .\n\n\n\nIBM Operational Decision Manager V8.12.0.1:\nInterim fix 043 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7282466 .\n\n\n\nIBM Operational Decision Manager V9.0.0.1:\nInterim fix 029 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7282488 .\n\n\n\n\u00a0IBM Operational Decision Manager V9.5.0.1:\nInterim fix 017 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7233740 .\n\n\n\n\u00a0IBM Operational Decision Manager V9.6.0.0:\nInterim fix 004 is available, see\u00a0 download document https://www.ibm.com/support/pages/node/7273804 .", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing the vulnerability now by upgrading.</p><p>IBM Operational Decision Manager V8.11.0.1<br/>Interim fix 060 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7283100\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V8.11.1:<br/>Interim fix 059 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7282614\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V8.12.0.1:<br/>Interim fix 043 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7282466\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V9.0.0.1:<br/>Interim fix 029 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7282488\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>\u00a0IBM Operational Decision Manager V9.5.0.1:<br/>Interim fix 017 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7233740\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>\u00a0IBM Operational Decision Manager V9.6.0.0:<br/>Interim fix 004 is available, see\u00a0<a href=\"https://www.ibm.com/support/pages/node/7273804\" rel=\"nofollow noopener noreferrer\">download document</a>.</p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7286196", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-09-11T11:49:18.618Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18658", "state": "PUBLISHED", "dateUpdated": "2026-09-11T11:49:18.618Z", "dateReserved": "2026-08-03T13:15:01.738Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-09-04T16:10:18.743Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:operational_decision_manager:9.6.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:*:*:*:*:*:*:*"], "product": "Operational Decision Manager", "vendor": "IBM", "versions": [{"status": "affected", "version": "9.6.0.0"}, {"status": "affected", "version": "9.5.0.0"}, {"status": "affected", "version": "8.11.1.0"}, {"status": "affected", "version": "8.11.0.1"}, {"status": "affected", "version": "8.12.0.1"}, {"status": "affected", "version": "9.5.0.1"}, {"status": "affected", "version": "9.0.0.1"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution."}], "id": "CVE-2026-18658", "lastModified": "2026-09-10T21:17:23.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18658", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-10T20:38:13.682174Z", "version": "2.0.3"}}]}, "published": "2026-09-04T16:17:21.133", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7286196"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.6.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.5.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8.11.1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8.11.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "8.12.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.5.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "9.0.0.1"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Operational Decision Manager", "source": "cna", "vendor": "IBM"}, "product": "operational_decision_manager", "vendor": "ibm"}], "created": "2026-09-04T19:15:07.704116+00:00", "updated": "2026-09-05T00:00:06.563070+00:00", "vendors": ["ibm", "ibm$PRODUCT$operational_decision_manager"]}