Quick answers
- Is CVE-2026-12084 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12084 being exploited in the wild.
- How severe is CVE-2026-12084?
- Medium severity, with a CVSS score of 5.4, published 30 June 2026.
- Which products and versions are affected?
- IBM Urbancode Deploy 8.1 through 8.1.2.6, 8.2 through 8.2.1.0.
- Is there a fix for CVE-2026-12084?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-12084 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-12084?
- Check whether you run IBM Urbancode Deploy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
IBM DevOps Deploy (formerly UrbanCode Deploy) versions 8.1.x and 8.2.x are vulnerable to a permissive Cross-Origin Resource Sharing (CORS) policy (CWE-942). The application fails to properly restrict the Access-Control-Allow-Origin header to trusted domains, allowing arbitrary origins to interact with the API. An unauthenticated remote attacker can exploit this by inducing a legitimate user to visit a malicious website. If the user is authenticated to the UCD server, the attacker's site can make cross-origin requests to perform actions with the user's privileges or exfiltrate sensitive data. The vulnerability is addressed in versions 8.1.2.7 and 8.2.2.0.
Affected products
- IBM DevOps Deploy / UrbanCode Deploy (UCD) 8.1 through 8.1.2.6, 8.2 through 8.2.1.0
Timeline
- 2026-06-23: advisory: Initial publication by IBM
- 2026-06-30: disclosed: NVD publication date