CVE-2026-19627: IBM Planning Analytics Local is affected by security vulnerabilities
Published Oct 12, 2026
·Updated
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.
Affected Software
5 affected components
IBM Planning Analytics Local=2.0, =2.1
IBM Planning Analytics=2.0
IBM Planning Analytics=2.1
IBM Planning Analytics<=2.0
IBM Planning Analytics<=2.1
Remediation
Information
It is strongly recommended that you apply the most recent security updates:
Affected Product(s)Version(s)FixIBM Planning Analytics Local2.1.0 - 2.1.23 IBM Planning Analytics Local 2.1.24 is now available for download from Fix Central https://w3.ibm.com/w3publisher/capa-release-announcements/2026-releases/pa-2026-releases
IBM Planning Analytics Cloud environment has been remediated.
Patch Available
Event History
Oct 12, 2026
CVE Published
via MITRE·10:40 PM
Data Sourced
via MITRE·10:40 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 15, 2026
Data Sourced
via IBM·10:53 PM
DescriptionAffected Software
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The issue is remotely exploitable and does not require privileges or user interaction, based on the supplied CVSS vector.
2
What is the potential impact of successful exploitation?
An attacker could read arbitrary files on the host and overwrite certain application files. The supplied severity information indicates high confidentiality impact and low integrity impact, with no availability impact indicated.
3
Which product versions are identified as affected?
The provided information identifies IBM Planning Analytics versions 2.0 and 2.1. The affected software is listed as IBM Planning Analytics Local.