CVE-2026-18541

5.4Medium

Published 12 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers can steal user session credentials or alter web UI behavior. Exploitation requires an attacker account and a legitimate user to view a manipulated page.

Root cause

The web UI fails to sanitize user-supplied input, allowing stored malicious JavaScript to execute in another user's session.

Affected systems

IBM Planning Analytics 2.0 and 2.1.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Apply the official patch from IBM advisory node 7291604; no interim configuration workaround is specified.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

References

https://www.ibm.com/support/pages/node/7291604PatchVendor Advisory

Source: nvd.nist.gov/vuln/detail/CVE-2026-18541