CVE-2026-17475: IBM Planning Analytics Local is affected by security vulnerabilities
Published Oct 12, 2026
·Updated
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.
Affected Software
5 affected components
IBM Planning Analytics Local=2.0, =2.1
IBM Planning Analytics=2.0
IBM Planning Analytics=2.1
IBM Planning Analytics<=2.0
IBM Planning Analytics<=2.1
Remediation
Information
It is strongly recommended that you apply the most recent security updates:
Affected Product(s)Version(s)FixIBM Planning Analytics Local2.1.0 - 2.1.23 IBM Planning Analytics Local 2.1.24 is now available for download from Fix Central https://w3.ibm.com/w3publisher/capa-release-announcements/2026-releases/pa-2026-releases
IBM Planning Analytics Cloud environment has been remediated.
Patch Available
Event History
Oct 12, 2026
CVE Published
via MITRE·10:40 PM
Data Sourced
via MITRE·10:40 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 15, 2026
Data Sourced
via IBM·10:53 PM
DescriptionAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker who is authenticated to IBM Planning Analytics Local could exploit it. The issue involves deleting folders and applications that belong to other users.
2
What access does an attacker need?
The attacker needs valid authenticated access; no user interaction is required. The provided severity vector indicates low privileges are sufficient.
3
What is the likely impact?
The disclosed impact is unauthorized deletion of other users’ folders and applications. The severity vector indicates high availability impact and low integrity impact, with no confidentiality impact.