{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-18658","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","state":"PUBLISHED","assignerShortName":"ibm","dateReserved":"2026-08-03T13:15:01.738Z","datePublished":"2026-09-04T16:10:18.743Z","dateUpdated":"2026-09-11T11:49:18.618Z"},"containers":{"cna":{"providerMetadata":{"orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm","dateUpdated":"2026-09-11T11:49:18.618Z"},"title":"IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","type":"CWE"}]}],"affected":[{"vendor":"IBM","product":"Operational Decision Manager","versions":[{"status":"affected","version":"9.6.0.0"},{"status":"affected","version":"9.5.0.0"},{"status":"affected","version":"8.11.1.0"},{"status":"affected","version":"8.11.0.1"},{"status":"affected","version":"8.12.0.1"},{"status":"affected","version":"9.5.0.1"},{"status":"affected","version":"9.0.0.1"}],"cpes":["cpe:2.3:a:ibm:operational_decision_manager:9.6.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:9.5.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:8.11.1.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:8.11.0.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:8.12.0.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:9.5.0.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:operational_decision_manager:9.0.0.1:*:*:*:*:*:*:*"]}],"descriptions":[{"lang":"en","value":"IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.</p>"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7286196","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseSeverity":"CRITICAL","baseScore":9.8,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"solutions":[{"lang":"en","value":"IBM strongly recommends addressing the vulnerability now by upgrading.\n\n\n\nIBM Operational Decision Manager V8.11.0.1\nInterim fix 060 is available, see  download document https://www.ibm.com/support/pages/node/7283100 .\n\n\n\nIBM Operational Decision Manager V8.11.1:\nInterim fix 059 is available, see  download document https://www.ibm.com/support/pages/node/7282614 .\n\n\n\nIBM Operational Decision Manager V8.12.0.1:\nInterim fix 043 is available, see  download document https://www.ibm.com/support/pages/node/7282466 .\n\n\n\nIBM Operational Decision Manager V9.0.0.1:\nInterim fix 029 is available, see  download document https://www.ibm.com/support/pages/node/7282488 .\n\n\n\n IBM Operational Decision Manager V9.5.0.1:\nInterim fix 017 is available, see  download document https://www.ibm.com/support/pages/node/7233740 .\n\n\n\n IBM Operational Decision Manager V9.6.0.0:\nInterim fix 004 is available, see  download document https://www.ibm.com/support/pages/node/7273804 .","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>IBM strongly recommends addressing the vulnerability now by upgrading.</p><p>IBM Operational Decision Manager V8.11.0.1<br/>Interim fix 060 is available, see <a href=\"https://www.ibm.com/support/pages/node/7283100\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V8.11.1:<br/>Interim fix 059 is available, see <a href=\"https://www.ibm.com/support/pages/node/7282614\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V8.12.0.1:<br/>Interim fix 043 is available, see <a href=\"https://www.ibm.com/support/pages/node/7282466\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p>IBM Operational Decision Manager V9.0.0.1:<br/>Interim fix 029 is available, see <a href=\"https://www.ibm.com/support/pages/node/7282488\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p> IBM Operational Decision Manager V9.5.0.1:<br/>Interim fix 017 is available, see <a href=\"https://www.ibm.com/support/pages/node/7233740\" rel=\"nofollow noopener noreferrer\">download document</a>.</p><p> IBM Operational Decision Manager V9.6.0.0:<br/>Interim fix 004 is available, see <a href=\"https://www.ibm.com/support/pages/node/7273804\" rel=\"nofollow noopener noreferrer\">download document</a>.</p>"}]}],"credits":[{"lang":"en","value":"Sonny of watchTowr (https://watchtowr.com/)","type":"finder"}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-18658","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-10T20:38:13.682174Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-10T21:00:34.810Z"}}]}}