CVE-2026-75061: IBM Planning Analytics Local is affected by security vulnerabilities

Published Oct 12, 2026

Updated

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

Affected Software

1 affected component

IBM Planning Analytics Local=2.0, =2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Planning Analytics Local to a version that resolves this vulnerability.
Fixed in 2.1.24

Event History

Oct 12, 2026

CVE Published

via MITRE·10:40 PM

Data Sourced

via MITRE·10:40 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue is remotely exploitable with low attack complexity and requires no privileges or user interaction. An attacker can send a specially crafted URL containing directory-traversal sequences.

What is the potential impact if exploitation succeeds?

An attacker could write arbitrary files on the affected system. The supplied severity vector indicates high integrity impact, with no stated confidentiality or availability impact.

Which product versions are identified as affected?

IBM Planning Analytics versions 2.0 and 2.1 are identified as affected. The affected software is IBM Planning Analytics Local.