ibm security advisories
41 threat alerts tracking vulnerabilities and security advisories that affect ibm products.
Vulnios monitors ibm CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent ibm security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2026-1346 — ibm — security_verify_access, security_verify_access_container
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Acces
criticalCVE-2026-1346Critical Vulnerability: CVE-2026-9170 — ibm — http_server
CVE-2026-9170 is a Critical-severity vulnerability tracked under the Common Vulnerabilities and Exposures program. It affects ibm http_server, and was added to the public CVE feed for security teams t
criticalCVE-2026-9170Critical Vulnerability: CVE-2016-3028 — ibm — security_access_manager, security_access_manager_for_web
IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by lever
criticalCVE-2016-3028Critical Vulnerability: CVE-2016-2944 — ibm — bigfix_remote_control
IBM BigFix Remote Control before 9.1.3 does not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach.
criticalCVE-2016-2944Critical Vulnerability: CVE-2016-0391 — ibm — watson_developer_cloud, bluemix
The IBM Watson Developer Cloud services on Bluemix platforms do not properly generate random numbers for service-instance credentials, which makes it easier for remote attackers to defeat cryptographi
criticalCVE-2016-0391Critical Vulnerability: CVE-2016-0224 — ibm — marketing_platform
SQL injection vulnerability in IBM Marketing Platform 8.5.x, 8.6.x, and 9.x before 9.1.2.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
criticalCVE-2016-0224Critical Vulnerability: CVE-2015-8521 — ibm — tivoli_storage_manager_fastback
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability th
criticalCVE-2015-8521Critical Vulnerability: CVE-2015-8520 — ibm — tivoli_storage_manager_fastback
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability th
criticalCVE-2015-8520Critical Vulnerability: CVE-2015-8519 — ibm — tivoli_storage_manager_fastback
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability th
criticalCVE-2015-8519Critical Vulnerability: CVE-2015-8522 — ibm — tivoli_storage_manager_fastback
Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability th
criticalCVE-2015-8522Critical Vulnerability: CVE-2015-7411 — ibm — tivoli_monitoring
The portal client in IBM Tivoli Monitoring (ITM) 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 through FP6 allows remote authenticated users to gain privileges via unspecified vectors.
criticalCVE-2015-7411Critical Vulnerability: CVE-2016-0216 — ibm — tivoli_storage_manager_fastback
Stack-based buffer overflow in IBM Tivoli Storage Manager FastBack 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a differe
criticalCVE-2016-0216Critical Vulnerability: CVE-2016-0212 — ibm — tivoli_storage_manager_fastback
Stack-based buffer overflow in IBM Tivoli Storage Manager FastBack 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a differe
criticalCVE-2016-0212Critical Vulnerability: CVE-2015-7425 — ibm — tivoli_storage_flashcopy_manager_for_vmware, tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware
The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.3 before 6.
criticalCVE-2015-7425Critical Vulnerability: CVE-2016-0213 — ibm — tivoli_storage_manager_fastback
Stack-based buffer overflow in IBM Tivoli Storage Manager FastBack 5.5 and 6.1.x through 6.1.11.1 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a differe
criticalCVE-2016-0213Critical Vulnerability: CVE-2015-7426 — ibm — spectrum_protect_for_virtual_environments, spectrum_protect_snapshot
The Data Protection extension in the VMware GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 7.1 before 7.1.3.0 an
criticalCVE-2015-7426Critical Vulnerability: CVE-2017-1710 — ibm — storwize_v7000_firmware, storwize_v7000
A vulnerability in the Service Assistant GUI in IBM Storwize V7000 (2076) 8.1 could allow a remote attacker to perform a privilege escalation. IBM X-Force ID: 134531.
criticalCVE-2017-1710Critical Vulnerability: CVE-2017-1221 — ibm — bigfix_platform
IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force I
criticalCVE-2017-1221Critical Vulnerability: CVE-2016-8937 — ibm — tivoli_storage_manager
The IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) default authentication protocol is vulnerable to a brute force attack due to disclosing too much information during authentication. An
criticalCVE-2016-8937Critical Vulnerability: CVE-2017-1376 — ibm — operations_analytics_predictive_insights
A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873.
criticalCVE-2017-1376Critical Vulnerability: CVE-2017-1383 — ibm — infosphere_information_server, softlayer
IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expo
criticalCVE-2017-1383Critical Vulnerability: CVE-2016-8964 — ibm — bigfix_inventory, license_metric_tool
IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 118853.
criticalCVE-2016-8964Critical Vulnerability: CVE-2017-1269 — ibm — security_guardium
IBM Security Guardium 10.0 and 10.1 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete informa
criticalCVE-2017-1269Critical Vulnerability: CVE-2017-1253 — ibm — security_guardium
IBM Security Guardium 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability
criticalCVE-2017-1253Critical Vulnerability: CVE-2017-1175 — ibm — maximo_asset_management
IBM Maximo Asset Management 7.1, 7.5, and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or dele
criticalCVE-2017-1175Critical Vulnerability: CVE-2017-1197 — ibm — bigfix_security_compliance_analytics
IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 123672.
criticalCVE-2017-1197Critical Vulnerability: CVE-2017-1196 — ibm — bigfix_security_compliance_analytics
IBM BigFix Compliance (TEMA SUAv1 SCA SCM) 1.9.70 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID:
criticalCVE-2017-1196Critical Vulnerability: CVE-2016-6087 — ibm — domino
IBM Domino 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data using Domino TLS Key Exchange validation. IBM X-Force ID: 117918.
criticalCVE-2016-6087Critical Vulnerability: CVE-2016-6093 — ibm — security_key_lifecycle_manager, tivoli_key_lifecycle_manager
IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
criticalCVE-2016-6093Critical Vulnerability: CVE-2017-1092 — ibm — informix_open_admin_tool
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID: 120390.
criticalCVE-2017-1092Critical Vulnerability: CVE-2016-6111 — ibm — curam_social_program_management
IBM Curam Social Program Management 6.0 and 7.0 are vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit
criticalCVE-2016-6111Critical Vulnerability: CVE-2016-9706 — ibm — integration_bus, websphere_message_broker
IBM Integration Bus 9.0 and 10.0 and WebSphere Message Broker SOAP FLOWS is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote
criticalCVE-2016-9706Critical Vulnerability: CVE-2016-0360 — ibm — websphere_mq_jms
IBM Websphere MQ JMS 7.0.1, 7.1, 7.5, 8.0, and 9.0 client provides classes that deserialize objects from untrusted sources which could allow a malicious user to execute arbitrary Java code by adding v
criticalCVE-2016-0360Critical Vulnerability: CVE-2016-8954 — ibm — dashdb_local
IBM dashDB Local uses hard-coded credentials that could allow a remote attacker to gain access to the Docker container or database.
criticalCVE-2016-8954Critical Vulnerability: CVE-2016-9005 — ibm — system_storage_ts3100-ts3200_tape_library
IBM System Storage TS3100-TS3200 Tape Library could allow an unauthenticated user with access to the company network, to change a user's password and gain remote access to the system.
criticalCVE-2016-9005Critical Vulnerability: CVE-2016-6095 — ibm — security_key_lifecycle_manager
IBM Tivoli Key Lifecycle Manager 2.5 and 2.6 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
criticalCVE-2016-6095Critical Vulnerability: CVE-2016-5964 — ibm — security_privileged_identity_manager
IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.
criticalCVE-2016-5964Critical Vulnerability: CVE-2016-6090 — ibm — websphere_commerce
IBM WebSphere Commerce contains an unspecified vulnerability that could allow disclosure of user personal data, performing of unauthorized administrative operations, and potentially causing a denial o
criticalCVE-2016-6090Critical Vulnerability: CVE-2016-6082 — ibm — bigfix_platform
IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free race condition. An attacker could exploit this vulnerability to execute arbitrary
criticalCVE-2016-6082Critical Vulnerability: CVE-2016-8938 — ibm — urbancode_deploy
IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be executed on the UCD agent machines that host cus
criticalCVE-2016-8938Critical Vulnerability: CVE-2016-2908 — ibm — security_access_manager_9.0_firmware, security_access_manager_for_mobile_8.0_firmware
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser. A remote attacker
criticalCVE-2016-2908
Track ibm exposure across your environment
Vulnios automatically cross-references your asset inventory against new ibm CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan