#IBM
All CosmicBytez Labs articles tagged #IBM, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-16823: Critical Authentication Bypass in IBM Verify Access and Identity Access
Critical CVSS 9.1 flaw (CVE-2026-16823) lets remote, unauthenticated attackers bypass security restrictions in IBM Verify Access/Identity Access.
- Security
CVE-2026-13260: IBM Verify Identity Access Remote Denial-of-Service Flaw
IBM Verify Identity Access lets a remote, unauthenticated attacker exhaust resources and cause denial of service via unvalidated requests.
- Security
CVE-2026-81832: XXE Flaw in IBM App Connect Enterprise SAP Adapter
A high-severity XXE vulnerability in IBM App Connect Enterprise's SAP Adapter lets low-privileged users exfiltrate confidential data via crafted XML.
- Security
Critical Session Hijack Flaw in IBM Administration Runtime Expert for i
CVE-2026-18527 (CVSS 9.9) lets unauthenticated attackers hijack another user's session in IBM ARE for i's legacy GUI, gaining elevated privileges.
- Security
IBM Concert SQL Injection Flaw Allows Unauthenticated Database Compromise
CVE-2026-3627 (CVSS 9.1) lets remote attackers run arbitrary SQL against IBM Concert 1.0.0-2.3.1 with no authentication, exposing the backend DB.
- Security
Critical RCE in IBM Langflow OSS via Unauthenticated A2A Endpoint
CVE-2026-19286 (CVSS 9.8) lets remote attackers execute arbitrary code on Langflow OSS 1.0.0-1.11.1 through the public A2A endpoint, no auth needed.
- Security
IBM Langflow OSS Flaw Lets Authenticated Users Escalate to Full RCE
CVE-2026-19295 (CVSS 9.9) lets an authenticated Langflow user run arbitrary OS commands by crafting a flow, bypassing the custom-component lockdown.
- Security
CVE-2026-16926: IBM AIX & PowerVM VIOS Critical Arbitrary File Overwrite
IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 have a critical flaw allowing remote attackers to overwrite arbitrary files. CVSS 9.1. Patch via IBM Fix Central.
- Security
CVE-2026-17482: Critical RCE in IBM Documentation Offline
IBM Documentation Offline versions 1.0.0–1.4.1 contain a critical path traversal flaw allowing remote code execution with a CVSS score of 9.8.
- Security
CVE-2026-11707: IBM WebSphere Application Server Admin Console XSS (CVSS 9.3)
Critical cross-site scripting vulnerability in IBM WebSphere Application Server's administrative console login page enables unauthenticated remote...
- Security
CVE-2026-15435: IBM App Connect Enterprise Path Traversal — Arbitrary File Write (CVSS 9.8)
Critical path traversal vulnerability in IBM App Connect Enterprise allows unauthenticated remote attackers to write arbitrary files on the system using...
- Security
CVE-2026-14446: IBM WebSphere Admin Console Privilege Escalation
A critical broken access control flaw (CVSS 9.8) in IBM WebSphere Application Server 8.5 and 9.0 allows attackers to escalate privileges via the...
- Security
CVE-2026-14512: IBM WebSphere Pre-Auth Deserialization Allows RCE
A critical pre-authentication unsafe deserialization flaw (CVSS 9.8) in IBM WebSphere Application Server 8.5 and 9.0 allows remote attackers to bypass...
- Security
CVE-2026-14958: IBM Aspera Faspex 5 Shell Injection Enables RCE
A critical unquoted shell interpolation vulnerability (CVSS 9.1) in IBM Aspera Faspex 5 (versions 5.0.0–5.0.15.4) allows authenticated remote attackers to...
- Security
CVE-2026-13446: IBM Langflow Hardcoded Credentials (CVSS 9.8)
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain hardcoded credentials used for inbound authentication and internal encryption, allowing...
- News
Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them.
IBM and Red Hat announced Project Lightwell — a $5 billion commitment to secure open-source supply chains using Anthropic's Mythos AI model, which found...
- Security
CVE-2025-36359: IBM DevOps Session Hijacking Vulnerability (CVSS 8.1)
IBM DevOps Automation and IBM DevOps Loop fail to invalidate session IDs after expiration, allowing authenticated attackers to impersonate other users via...
- News
IBM and Red Hat Commit $5 Billion to Secure Open Source Supply Chains Under "Project Lightwell"
IBM and Red Hat unveil Project Lightwell, a $5B commitment to securing open-source supply chains by fixing vulnerabilities without breaking production.