CVE-2026-12735: IBM Controller Disclosure Management has addressed vulnerabilities

Q: Who can exploit this issue?

An attacker needs low-level privileges and network access to the affected IBM Controller Disclosure Management deployment. No user interaction is required, and the attack complexity is low.

Q: Which deployments are explicitly identified as affected?

IBM Controller Disclosure Management version 1.0.0.0 is explicitly identified. The available information does not state whether other versions or configurations are affected.

Q: What is the expected impact if exploitation succeeds?

The impact is limited to confidentiality: an attacker may obtain sensitive EXIF metadata from uploaded images. No integrity or availability impact is identified.

Published Oct 29, 2026

Updated

IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper removal of sensitive information before storage.

Other sources

IBM Controller Disclosure Management could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper removal of sensitive information before storage.

— IBM

Affected Software

1 affected component

IBM Controller Disclosure Management<=1.0.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Controller Disclosure Management to a version that resolves this vulnerability.
Fixed in 1.0.1.0

Event History

Oct 29, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·05:12 PM

Data Sourced

via MITRE·05:12 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294527

Frequently Asked Questions

Who can exploit this issue?

An attacker needs low-level privileges and network access to the affected IBM Controller Disclosure Management deployment. No user interaction is required, and the attack complexity is low.

Which deployments are explicitly identified as affected?

IBM Controller Disclosure Management version 1.0.0.0 is explicitly identified. The available information does not state whether other versions or configurations are affected.

What is the expected impact if exploitation succeeds?

The impact is limited to confidentiality: an attacker may obtain sensitive EXIF metadata from uploaded images. No integrity or availability impact is identified.

CVE-2026-12735: IBM Controller Disclosure Management has addressed vulnerabilities

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

Which deployments are explicitly identified as affected?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are explicitly identified as affected?

What is the expected impact if exploitation succeeds?