CVE-2026-19627: IBM Planning Analytics Local is affected by security vulnerabilities

Published Oct 12, 2026

Updated

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths.

Affected Software

1 affected component

IBM Planning Analytics Local=2.0, =2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Planning Analytics Local to a version that resolves this vulnerability.
Fixed in 2.1.24

Event History

Oct 12, 2026

CVE Published

via MITRE·10:40 PM

Data Sourced

via MITRE·10:40 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is remotely exploitable and does not require privileges or user interaction, based on the supplied CVSS vector.

What is the potential impact of successful exploitation?

An attacker could read arbitrary files on the host and overwrite certain application files. The supplied severity information indicates high confidentiality impact and low integrity impact, with no availability impact indicated.

Which product versions are identified as affected?

The provided information identifies IBM Planning Analytics versions 2.0 and 2.1. The affected software is listed as IBM Planning Analytics Local.