CVE-2026-75061: IBM Planning Analytics Local is affected by security vulnerabilities
Published Oct 12, 2026
·Updated
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.
Affected Software
5 affected components
IBM Planning Analytics Local=2.0, =2.1
IBM Planning Analytics=2.0
IBM Planning Analytics=2.1
IBM Planning Analytics<=2.0
IBM Planning Analytics<=2.1
Remediation
Information
It is strongly recommended that you apply the most recent security updates:
Affected Product(s)Version(s)FixIBM Planning Analytics Local2.1.0 - 2.1.23IBM Planning Analytics Local 2.1.24 is now available for download from Fix CentralIBM Planning Analytics Cloud environment has been remediated.
Patch Available
Event History
Oct 12, 2026
CVE Published
via MITRE·10:40 PM
Data Sourced
via MITRE·10:40 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 15, 2026
Data Sourced
via IBM·10:53 PM
DescriptionAffected Software
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. An attacker can send a specially crafted URL containing directory-traversal sequences.
2
What is the potential impact if exploitation succeeds?
An attacker could write arbitrary files on the affected system. The supplied severity vector indicates high integrity impact, with no stated confidentiality or availability impact.
3
Which product versions are identified as affected?
IBM Planning Analytics versions 2.0 and 2.1 are identified as affected. The affected software is IBM Planning Analytics Local.