CVE-2026-18658CWE-89sql-injection

CVE-2026-18658

Critical · published September 4, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
36.4
In the wild
Unconfirmed
What it is

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00432 · 36.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-09-04T20:17Z
References (1)
https://www.ibm.com/support/pages/node/7286196 · [email protected]
EPSS history
Timeline
  • 06 SEP 03:30Z
    EPSS moved — → 0%
    epss
  • 04 SEP 16:10Z
    IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed
    cvelistv5