CVE-2026-18541: IBM Planning Analytics Local is affected by security vulnerabilities

Q: Who can exploit this issue?

An authenticated user of the Web UI can exploit it by embedding arbitrary JavaScript. The issue is therefore most relevant where untrusted or lower-privileged users can create or modify content viewed by other users.

Q: What is the likely impact if exploitation succeeds?

Injected script can alter Web UI functionality and may disclose credentials from a trusted user session. The CVSS vector indicates low impacts to confidentiality and integrity, with no availability impact stated.

Q: Which versions are identified as affected?

IBM Planning Analytics versions 2.0 and 2.1 are identified as vulnerable.

Published Oct 12, 2026

Updated

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

5 affected components

IBM Planning Analytics Local=2.0, =2.1

IBM Planning Analytics=2.0

IBM Planning Analytics=2.1

IBM Planning Analytics<=2.0

IBM Planning Analytics<=2.1

Remediation

Information

It is strongly recommended that you apply the most recent security updates: Affected Product(s)Version(s)FixIBM Planning Analytics Local2.1.0 - 2.1.23 IBM Planning Analytics Local 2.1.24 is now available for download from Fix Central https://w3.ibm.com/w3publisher/capa-release-announcements/2026-releases/pa-2026-releases IBM Planning Analytics Cloud environment has been remediated.

Patch Available

https://www.ibm.com/support/pages/node/7291604

Event History

Oct 12, 2026

CVE Published

via MITRE·10:40 PM

Data Sourced

via MITRE·10:40 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

RemedyDescriptionSeverityWeaknessAffected Software

Oct 15, 2026

Data Sourced

via IBM·10:53 PM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7291604

Frequently Asked Questions

Who can exploit this issue?

An authenticated user of the Web UI can exploit it by embedding arbitrary JavaScript. The issue is therefore most relevant where untrusted or lower-privileged users can create or modify content viewed by other users.

What is the likely impact if exploitation succeeds?

Injected script can alter Web UI functionality and may disclose credentials from a trusted user session. The CVSS vector indicates low impacts to confidentiality and integrity, with no availability impact stated.

Which versions are identified as affected?

IBM Planning Analytics versions 2.0 and 2.1 are identified as vulnerable.

CVE-2026-18541: IBM Planning Analytics Local is affected by security vulnerabilities

Affected Software

Remediation

Information

Patch Available

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if exploitation succeeds?

Which versions are identified as affected?

Company

Resources

Contact