CVE-2026-18541: IBM Planning Analytics Local is affected by security vulnerabilities

Published Oct 12, 2026

Updated

IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Affected Software

1 affected component

IBM Planning Analytics Local=2.0, =2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Planning Analytics Local to a version that resolves this vulnerability.
Fixed in 2.1.24

Event History

Oct 12, 2026

CVE Published

via MITRE·10:40 PM

Data Sourced

via MITRE·10:40 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user of the Web UI can exploit it by embedding arbitrary JavaScript. The issue is therefore most relevant where untrusted or lower-privileged users can create or modify content viewed by other users.

What is the likely impact if exploitation succeeds?

Injected script can alter Web UI functionality and may disclose credentials from a trusted user session. The CVSS vector indicates low impacts to confidentiality and integrity, with no availability impact stated.

Which versions are identified as affected?

IBM Planning Analytics versions 2.0 and 2.1 are identified as vulnerable.