Executive brief
IBM Operational Decision Manager is a business rules and decision management platform used by enterprises to automate complex decision logic. A critical SQL injection vulnerability allows unauthenticated attackers to execute arbitrary SQL queries against the application's database and write malicious code files to the web server, enabling complete remote takeover of the system.
Technical details
The vulnerability is a SQL injection (CWE-89) in IBM Operational Decision Manager that allows unauthenticated attackers to execute arbitrary SQL statements. The vulnerable component does not properly sanitize or parameterize user-supplied input before using it in SQL queries. Since authentication is not required, the attack is accessible over the network. An attacker can leverage database functionality and file-write permissions to write a web shell to the application's web root, achieving remote code execution with the privileges of the application process.
Affected products
- IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 9.5.0.1, 9.0.0.1, 8.12.0.1, 8.11.1.0, 8.11.0.1
Timeline
- 2026-09-04: disclosed