# CVE-2026-8636: IBM Datacap sensitive information disclosure in memory

Source: https://junglewise.ai/threats/cve-2026-8636-ibm-datacap-sensitive-information-disclosure-in-memory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-22  
License: CC BY 4.0 with a link back

CVE-2026-8636 · Severity: medium · CVSS 5.5 · Published 2026-06-22

IBM Datacap, a platform used for automated data capture and document processing, contains a security flaw that could allow an authorized user on the system to extract sensitive information from the computer's memory. Specifically, an attacker could retrieve user passwords and the cryptographic keys used to protect them. This could lead to unauthorized access to the application and the sensitive business data stored within its database.

Technologies: [IBM Datacap](https://junglewise.ai/threats/technologies/datacap), [IBM Datacap Navigator](https://junglewise.ai/threats/technologies/datacap-navigator). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm).

## Quick answers

**Is CVE-2026-8636 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8636 being exploited in the wild.

**How severe is CVE-2026-8636?** Medium severity, with a CVSS score of 5.5, published 22 June 2026.

**Which products and versions are affected?** IBM Datacap 9.1.7, 9.1.8, 9.1.9; IBM Datacap Navigator 9.1.7, 9.1.8, 9.1.9.

**Is there a fix for CVE-2026-8636?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8636 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-8636?** Check whether you run IBM Datacap or IBM Datacap Navigator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

IBM Datacap and Datacap Navigator are vulnerable to cleartext storage of sensitive information in memory (CWE-316). A local attacker with low-level privileges can exploit this to retrieve user passwords and the cryptographic keys used for their encryption. By obtaining these keys, the attacker can decrypt stored passwords, gain unauthorized access to the Datacap application, and subsequently access sensitive data within the backend database. The vulnerability is addressed in IBM Datacap version 9.1.9 Interim Fix 008.

## Affected products

- IBM Datacap 9.1.7, 9.1.8, 9.1.9
- IBM Datacap Navigator 9.1.7, 9.1.8, 9.1.9

## Timeline

- 2026-06-16: advisory: Initial publication by IBM
- 2026-06-22: disclosed: NVD publication date

## References

- [https://www.ibm.com/support/pages/node/7276609](https://www.ibm.com/support/pages/node/7276609)

## Related threats

- [IBM Datacap forced browsing access control bypass](https://junglewise.ai/threats/cve-2026-9610-ibm-datacap-forced-browsing-access-control-bypass)
- [IBM Datacap cross-site scripting in Navigator Web UI](https://junglewise.ai/threats/cve-2026-8059-ibm-datacap-cross-site-scripting-in-navigator-web-ui)