CVE-2026-18658

Summary

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

Affected Software

VendorProductVersion RangeStatus
IBMOperational Decision Manager9.6.0.0affected
IBMOperational Decision Manager9.5.0.0affected
IBMOperational Decision Manager8.11.1.0affected
IBMOperational Decision Manager8.11.0.1affected
IBMOperational Decision Manager8.12.0.1affected
IBMOperational Decision Manager9.5.0.1affected
IBMOperational Decision Manager9.0.0.1affected

Weaknesses

  • CWE-89: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

References