Overview
A critical remote code execution vulnerability has been disclosed in IBM Documentation Offline, affecting all versions from 1.0.0 through 1.4.1. Tracked as CVE-2026-17482 and assigned a CVSS v3.1 base score of 9.8 (Critical), the flaw allows a remote attacker to execute arbitrary code on vulnerable systems due to improper control of file paths.
The vulnerability was published to the National Vulnerability Database (NVD) on August 13, 2026.
Vulnerability Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-17482 |
| CVSS Score | 9.8 (Critical) |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Affected Product | IBM Documentation Offline 1.0.0 – 1.4.1 |
The root cause is improper control of file paths — a class of vulnerability that typically manifests as path traversal or directory traversal. When an application fails to properly sanitize or canonicalize user-supplied file paths, an attacker can supply specially crafted input to escape intended directories and access or write arbitrary files on the system. In the context of a documentation application with code execution capabilities, this can lead directly to remote code execution without requiring authentication.
Impact
A successful exploit could allow a remote, unauthenticated attacker to:
- Execute arbitrary code on the host system
- Read or write files outside of intended directories
- Escalate privileges depending on the service account context
- Potentially pivot to other systems on the same network
Given the zero-authentication requirement and network accessibility, this vulnerability carries significant risk for any deployment of IBM Documentation Offline that is reachable from an untrusted network.
Affected Versions
- IBM Documentation Offline 1.0.0 through 1.4.1 (inclusive)
Remediation
IBM has issued a security bulletin for this vulnerability. Organizations using IBM Documentation Offline should:
- Apply the vendor patch immediately — check IBM's official security bulletin for the fixed version
- Restrict network access to the Documentation Offline service as an interim mitigation
- Review logs for any unusual file access or execution patterns
- Audit service account permissions to limit blast radius if exploitation has occurred
If a patch is not immediately available or deployable, consider taking the service offline or placing it behind a VPN or firewall until the fix can be applied.
References
- NVD Entry: CVE-2026-17482
- IBM Security Bulletins — IBM Support Portal