CVE-2026-75063

5.4Medium

Published 12 Oct 2026 · NVD status: Analyzed · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Attackers can run arbitrary JavaScript in a victim's browser session to steal sensitive data or perform actions on their behalf. This requires an attacker to inject code into the application and trick an authenticated user into viewing it.

Root cause

Improper output encoding allows user-supplied data to be rendered as executable script in the web application.

Affected systems

IBM Planning Analytics 2.0 and 2.1.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Fix & remediation

Upgrade to the patched release specified in IBM advisory node 7291604. No workarounds or interim mitigations are provided.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.

References

https://www.ibm.com/support/pages/node/7291604PatchVendor Advisory

Source: nvd.nist.gov/vuln/detail/CVE-2026-75063