# CVE-2026-19620: IBM Planning Analytics authentication bypass

Source: https://junglewise.ai/threats/cve-2026-19620-ibm-planning-analytics-2-0-and-2-1-could-allow-a-remote-attacker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-19620 · Severity: high · CVSS 8.8 · Published 2026-10-12

IBM Planning Analytics is a business planning and budgeting tool used by enterprises to manage financial forecasts and corporate strategy. An improper authentication vulnerability allows a remote attacker to bypass login requirements and gain full administrative access, potentially exposing sensitive business data and enabling unauthorized system changes.

Technologies: [IBM Planning Analytics](https://junglewise.ai/threats/technologies/planning-analytics). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-19620 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19620 being exploited in the wild.

**How severe is CVE-2026-19620?** High severity, with a CVSS score of 8.8, published 12 October 2026.

**Which products and versions are affected?** IBM Planning Analytics 2.0, 2.1.

**Is there a fix for CVE-2026-19620?** Yes: fixed in IBM Planning Analytics Workspace version 2.1.24. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19620 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-19620?** Check whether you run IBM Planning Analytics at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in IBM Planning Analytics Workspace version 2.1.24

## Technical details

IBM Planning Analytics 2.0 and 2.1 contain an authentication bypass vulnerability (CWE-288) in its authentication mechanism, allowing an attacker with low-level credentials to escalate to administrative access. The vulnerability is reachable via the network with low attack complexity and requires only low privileges, resulting in high impact to confidentiality, integrity, and availability of the system.

## Affected products

- IBM Planning Analytics 2.0, 2.1

## Timeline

- 2026-10-12: disclosed

## References

- [https://www.ibm.com/support/pages/node/7291604](https://www.ibm.com/support/pages/node/7291604)

## Related threats

- [IBM Planning Analytics stack-based buffer overflow in TM1 OData engine](https://junglewise.ai/threats/cve-2026-76587-ibm-planning-analytics-2-0-and-2-1-are-vulnerable-to-a-stack)
- [IBM Planning Analytics stack-based buffer overflow](https://junglewise.ai/threats/cve-2026-85457-ibm-planning-analytics-2-0-and-2-1-could-allow-a-remote)
- [IBM Planning Analytics cross-site scripting in JavaScript output encoding](https://junglewise.ai/threats/cve-2026-75063-ibm-planning-analytics-2-0-and-2-1-could-allow-a-remote)
- [IBM Planning Analytics path traversal in workspace component](https://junglewise.ai/threats/cve-2026-75061-ibm-planning-analytics-2-0-and-2-1-could-allow-a-remote-attacker)
- [IBM Planning Analytics path validation bypass](https://junglewise.ai/threats/cve-2026-19627-ibm-planning-analytics-2-0-and-2-1-could-allow-a-remote-attacker)