IBM vulnerabilities in CISA KEV
IBM has 8 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 33rd highest of any vendor. 1 was added in the last 12 months; 2 are linked to known ransomware use (25% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 181 days (range 3 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Data Risk Manager, with 3 entries. Other frequently affected products: Aspera Faspex (1); InfoSphere BigInsights (1).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor ibm --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
8
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-08-04
most recent entry
┌─ last 12 months
1
entries added
┌─ ransomware use
2 of 8
25% linked to ransomware
┌─ distinct products
6
affected products
$ awk -F, {print $1} /var/log/kev/ibm.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 4 | 0 |
| 2022 | 2 | 1 |
| 2023 | 1 | 1 |
| 2026 | 1 | 0 |
$ sort /var/log/kev/ibm.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Data Risk Manager 3 entries
- Aspera Faspex 1 entry
- InfoSphere BigInsights 1 entry
- Langflow 1 entry
- Planning Analytics 1 entry
$ kev-due-dates --vendor ibm
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ IBM
181 days (range 3 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/ibm.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (7 of 8 have at least one CWE).
$ grep -ril 'IBM' /var/log/news | head -5
Our reporting that names IBM or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./ibm.kev · 8 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-9198
Langflow
IBM Langflow Code Injection Vulnerability
due 2026-08-07 · CWE-94
$ cat CVE-2026-9198.txt
Description. Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2022-47986
Aspera Faspex [RANSOMWARE]
IBM Aspera Faspex Code Execution Vulnerability
due 2023-03-14 · CWE-502
$ cat CVE-2022-47986.txt
Description. IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.
Required action. Apply updates per vendor instructions.
- CVE-2013-3993
InfoSphere BigInsights [RANSOMWARE]
IBM InfoSphere BigInsights Invalid Input Vulnerability
due 2022-06-15 · CWE-264
$ cat CVE-2013-3993.txt
Description. Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2015-7450
WebSphere Application Server and Server Hypervisor Edition
IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
due 2022-07-10 · CWE-94
$ cat CVE-2015-7450.txt
Description. Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands
Required action. Apply updates per vendor instructions.
- CVE-2019-4716
Planning Analytics
IBM Planning Analytics Remote Code Execution Vulnerability
due 2022-05-03 · CWE-94
$ cat CVE-2019-4716.txt
Description. IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting.
Required action. Apply updates per vendor instructions.
- CVE-2020-4427
Data Risk Manager
IBM Data Risk Manager Security Bypass Vulnerability
due 2022-05-03
$ cat CVE-2020-4427.txt
Description. IBM Data Risk Manager contains a security bypass vulnerability that could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could exploit this vulnerability to bypass the authentication process and gain full administrative access to the system.
Required action. Apply updates per vendor instructions.
- CVE-2020-4428
Data Risk Manager
IBM Data Risk Manager Remote Code Execution Vulnerability
due 2022-05-03 · CWE-78
$ cat CVE-2020-4428.txt
Description. IBM Data Risk Manager contains an unspecified vulnerability which could allow a remote, authenticated attacker to execute commands on the system.�
Required action. Apply updates per vendor instructions.
- CVE-2020-4430
Data Risk Manager
IBM Data Risk Manager Directory Traversal Vulnerability
due 2022-05-03 · CWE-22
$ cat CVE-2020-4430.txt
Description. IBM Data Risk Manager contains a directory traversal vulnerability that could allow a remote authenticated attacker to traverse directories and send a specially crafted URL request to download arbitrary files from the system.
Required action. Apply updates per vendor instructions.