IBM Planning Analytics Security Bulletin: Multiple CVEs Fixed (RCE, XSS, Auth Bypass)

Vulnerability Overview IBM Planning Analytics Local is affected by multiple security vulnerabilities, which have been addressed in IBM Planning Analytics Local v2.0 - IBM Planning Analytics Workspace version 2.1.24. Affected Scope CVE-2026-75063: IBM Planning Analytics Local may allow remote authenticated attackers to execute arbitrary JavaScript via incorrect output encoding. CVE-2026-41213: The @node-oauth/oauth2-server module, when implemented as an OAuth2 server, may allow attackers to guess authorization codes through brute-forcing of the code verifier. CVE-2026-39825: ReverseProxy may allow forwarding of queries containing invisible parameters, bypassing the Rewrite function. CVE-2026-59887: The linkify-it library may experience increased CPU consumption due to unhandled Unicode support. CVE-2026-19622: IBM Planning Analytics Local may allow remote attackers to bypass authentication and escalate privileges. CVE-2026-23903: Apache Shiro has an authentication bypass vulnerability affecting static file access. CVE-2026-23901: Apache Shiro has an observable time difference vulnerability, which may lead to brute-force attacks. CVE-2026-11536: IBM WebSphere Application Server 9.0 and 8.5 have a remote code execution vulnerability. CVE-2026-23745: The node-tar library may allow bypassing extraction root restrictions via hard links and symbolic links. CVE-2026-24842: The node-tar library may allow creation of malicious TAR archives via hard links. CVE-2026-75061: IBM Planning Analytics Local may allow writing arbitrary files via special URL requests. CVE-2026-50645: Apache CXF has an unrestricted message attachment header count, which may lead to denial of service. CVE-2026-9322: IBM WebSphere Application Server 9.0 and 8.5 have a denial of service vulnerability via crafted HTTP requests. CVE-2026-9171: IBM WebSphere Application Server and Liberty have a denial of service vulnerability via crafted requests. CVE-2026-15057: IBM WebSphere Application Server - Liberty has a denial of service vulnerability caused by uncontrolled heap allocation. CVE-2026-18541: IBM Planning Analytics Local has a stored cross-site scripting vulnerability, which may lead to credential leakage. CVE-2026-34477: Log4j has an incomplete fix, which may lead to man-in-the-middle attacks. CVE-2026-54512: jackson-databind has an incomplete disallowed input list, which may lead to bypassing PTV checks. CVE-2026-54513: jackson-databind has an incomplete disallowed input list, which may lead to bypassing PTV checks. CVE-2026-54514: jackson-databind has a server-side request forgery vulnerability, which may lead to DNS queries. CVE-2026-54515: jackson-databind has an improper control modification vulnerability for dynamically determined object properties. CVE-2026-54516: jackson-databind has an improper control modification vulnerability for dynamically determined object properties. CVE-2026-54517: jackson-databind has an improper control modification vulnerability for dynamically determined object properties. Remediation CVE-2026-75063: Upgrade to IBM Planning Analytics Local v2.0 - IBM Planning Analytics Workspace version 2.1.24. CVE-2026-41213: Upgrade to the latest version of @node-oauth/oauth2-server. CVE-2026-39825: Upgrade to the latest version of ReverseProxy. CVE-2026-59887: Upgrade to the latest version of linkify-it. CVE-2026-19622: Upgrade to the latest version of IBM Planning Analytics Local. CVE-2026-23903: Upgrade to Apache Shiro 2.0.7 or later. CVE-2026-23901: Upgrade to Apache Shiro 2.0.7 or later. CVE-2026-11536: Upgrade to the latest version of IBM WebSphere Application Server. CVE-2026-23745: Upgrade to the latest version of node-tar. CVE-2026-24842: Upgrade to the latest version of node-tar. CVE-2026-75061: Upgrade to the latest version of IBM Planning Analytics Local. CVE-2026-50645: Upgrade to the latest version of Apache CXF. CVE-2026-9322: Upgrade to the latest version of IBM WebSphere Application Server. CVE-2026-9171: Upgrade to the latest version of IBM WebSphere Application Server. CVE-2026-15057: Upgrade to the latest version of IBM WebSphere Application Server - Liberty. CVE-2026-18541: Upgrade to the latest version of IBM Planning Analytics Local. CVE-2026-34477: Upgrade to Log4j Core 2.25.4 or later. CVE-2026-54512: Upgrade to the latest version of jackson-databind. CVE-2026-54513: Upgrade to the latest version of jackson-databind. CVE-2026-54514: Upgrade to the latest version of jackson-databind. CVE-2026-54515: Upgrade to the latest version of jackson-databind. CVE-2026-54516: Upgrade to the latest version of jackson-databind. CVE-2026-54517: Upgrade to the latest version of jackson-databind. POC Code or Exploit Code No specific POC code or exploit code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Planning Analytics Security Bulletin: Multiple CVEs Fixed (RCE, XSS, Auth Bypass)

More from this source