CVE-2026-95867

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-95867", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-09-22T17:02:58.971Z", "datePublished": "2026-11-08T19:44:13.593Z", "dateUpdated": "2026-11-09T01:21:10.563Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T19:44:13.593Z"}, "title": "Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "SevOne Network Performance Management", "versions": [{"status": "affected", "version": "7.0.0", "lessThanOrEqual": "8.2.2", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:sevone_network_performance_management:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sevone_network_performance_management:8.2.2:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7289655", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.7, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "solutions": [{"lang": "en", "value": "IBM SevOne Network Performance Management has previously remediated the vulnerabilities listed in this bulletin through product maintenance and updates.\u00a0\n\nThis security bulletin is being published as a historical reference to align with current security disclosure practices and does not contain new findings.\n\n\n\nIBM strongly recommends addressing these vulnerabilities now by upgrading. Please refer to the instructions below for installation steps for your specific version.\n\nProduct(s)\n\nLatest Version(s)\u00a0\n\nRemediation/Fix/InstructionsIBM SevOne Network Performance Management (DI)8.2.4 Download https://www.ibm.com/support/fixcentral/quickorder and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0 IBM SevOne Network Performance Management (NMS)8.2.3 Download https://www.ibm.com/support/fixcentral/swg/selectFixes and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0 IBM SevOne Network Performance Management (SD-WAN)8.2.3 Download https://www.ibm.com/support/fixcentral/swg/selectFixes and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><em><strong>IBM SevOne Network Performance Management has previously remediated the vulnerabilities listed in this bulletin through product maintenance and updates.\u00a0</strong></em></div><div><em>This security bulletin is being published as a historical reference to align with current security disclosure practices and does not contain new findings.</em></div><div><p>IBM strongly recommends addressing these vulnerabilities now by upgrading. Please refer to the instructions below for installation steps for your specific version.</p><figure><div><table><tbody><tr><td>Product(s)</td><td><p>Latest Version(s)\u00a0</p></td><td>Remediation/Fix/Instructions</td></tr><tr><td>IBM SevOne Network Performance Management (DI)</td><td>8.2.4</td><td><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management&amp;fixids=8.2.0-IBM-SevOne-DI_8.2.4&amp;source=SAR\" rel=\"noopener noreferrer nofollow\">Download</a> and refer to the <a href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=insight-data-82-release-notes\" rel=\"nofollow\">release notes</a></td></tr><tr><td>IBM SevOne Network Performance Management (NMS)</td><td>8.2.3</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management&amp;fixids=8.2.0-IBM-SevOne-NMS_8.2.3&amp;source=dbluesearch&amp;function=fixId&amp;parent=ibm/Other%20software\" rel=\"noopener noreferrer nofollow\">Download</a> and refer to the <a href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=nms-82-release-notes\" rel=\"noopener noreferrer nofollow\">release notes</a></td></tr><tr><td>IBM SevOne Network Performance Management (SD-WAN)</td><td>8.2.3</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management&amp;fixids=8.2.0-IBM-SevOne-SDWAN_8.2.3&amp;source=SAR&amp;function=fixId&amp;parent=ibm/Other%20software\" rel=\"noopener noreferrer nofollow\">Download</a> and refer to the <a href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=wan-sd-82-release-notes\" rel=\"noopener noreferrer nofollow\">release notes</a></td></tr></tbody></table></div></figure></div>"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T01:20:55.462977Z", "id": "CVE-2026-95867", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T01:21:10.563Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:sevone_network_performance_management:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sevone_network_performance_management:8.2.2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "SevOne Network Performance Management", "versions": [{"status": "affected", "version": "7.0.0", "versionType": "semver", "lessThanOrEqual": "8.2.2"}]}], "solutions": [{"lang": "en", "value": "IBM SevOne Network Performance Management has previously remediated the vulnerabilities listed in this bulletin through product maintenance and updates.\u00a0\n\nThis security bulletin is being published as a historical reference to align with current security disclosure practices and does not contain new findings.\n\n\n\nIBM strongly recommends addressing these vulnerabilities now by upgrading. Please refer to the instructions below for installation steps for your specific version.\n\nProduct(s)\n\nLatest Version(s)\u00a0\n\nRemediation/Fix/InstructionsIBM SevOne Network Performance Management (DI)8.2.4 Download https://www.ibm.com/support/fixcentral/quickorder and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0 IBM SevOne Network Performance Management (NMS)8.2.3 Download https://www.ibm.com/support/fixcentral/swg/selectFixes and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0 IBM SevOne Network Performance Management (SD-WAN)8.2.3 Download https://www.ibm.com/support/fixcentral/swg/selectFixes and refer to the release notes https://www.ibm.com/docs/en/sevone-npm/8.2.0", "supportingMedia": [{"type": "text/html", "value": "<div><em><strong>IBM SevOne Network Performance Management has previously remediated the vulnerabilities listed in this bulletin through product maintenance and updates.\u00a0</strong></em></div><div><em>This security bulletin is being published as a historical reference to align with current security disclosure practices and does not contain new findings.</em></div><div><p>IBM strongly recommends addressing these vulnerabilities now by upgrading. Please refer to the instructions below for installation steps for your specific version.</p><figure><div><table><tbody><tr><td>Product(s)</td><td><p>Latest Version(s)\u00a0</p></td><td>Remediation/Fix/Instructions</td></tr><tr><td>IBM SevOne Network Performance Management (DI)</td><td>8.2.4</td><td><a href=\"https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management&amp;fixids=8.2.0-IBM-SevOne-DI_8.2.4&amp;source=SAR\" rel=\"noopener noreferrer nofollow\">Download</a> and refer to the <a href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=insight-data-82-release-notes\" rel=\"nofollow\">release notes</a></td></tr><tr><td>IBM SevOne Network Performance Management (NMS)</td><td>8.2.3</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management&amp;fixids=8.2.0-IBM-SevOne-NMS_8.2.3&amp;source=dbluesearch&amp;function=fixId&amp;parent=ibm/Other%20software\" rel=\"noopener noreferrer nofollow\">Download</a> and refer to the <a href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=nms-82-release-notes\" rel=\"noopener noreferrer nofollow\">release notes</a></td></tr><tr><td>IBM SevOne Network Performance Management (SD-WAN)</td><td>8.2.3</td><td><a href=\"https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+SevOne+Network+Performance+Management&amp;fixids=8.2.0-IBM-SevOne-SDWAN_8.2.3&amp;source=SAR&amp;function=fixId&amp;parent=ibm/Other%20software\" rel=\"noopener noreferrer nofollow\">Download</a> and refer to the <a href=\"https://www.ibm.com/docs/en/sevone-npm/8.2.0?topic=wan-sd-82-release-notes\" rel=\"noopener noreferrer nofollow\">release notes</a></td></tr></tbody></table></div></figure></div>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7289655", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en", "value": "IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-11-08T19:44:13.593Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-95867", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-09T01:20:55.462977Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-11-09T01:21:03.168Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-95867", "state": "PUBLISHED", "dateUpdated": "2026-11-08T19:44:13.593Z", "dateReserved": "2026-09-22T17:02:58.971Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-11-08T19:44:13.593Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:ibm:sevone_network_performance_management:7.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:sevone_network_performance_management:8.2.2:*:*:*:*:*:*:*"], "product": "SevOne Network Performance Management", "vendor": "IBM", "versions": [{"lessThanOrEqual": "8.2.2", "status": "affected", "version": "7.0.0", "versionType": "semver"}]}], "source": "psirt@us.ibm.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow."}], "id": "CVE-2026-95867", "lastModified": "2026-11-09T02:17:00.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "psirt@us.ibm.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-95867", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T01:20:55.462977Z", "version": "2.0.3"}}]}, "published": "2026-11-08T20:17:25.020", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7289655"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "psirt@us.ibm.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,8.2.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "SevOne Network Performance Management", "source": "cna", "vendor": "IBM"}, "product": "sevone_network_performance_management", "vendor": "ibm"}], "created": "2026-11-08T21:30:17.156995+00:00", "title": "Local Buffer Overflow Allowing Arbitrary Code Execution in IBM SevOne Network Performance Management", "updated": "2026-11-08T21:45:06.730816+00:00", "vendors": ["ibm", "ibm$PRODUCT$sevone_network_performance_management"]}