CVE-2026-18658

critical · 9.8

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

9.8

CVSS

0.8%

EPSS (exploit prob.)

56th

EPSS percentile

2026-09-04

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

References

https://www.ibm.com/support/pages/node/7286196

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-18658