CVE-2026-75063: IBM Planning Analytics Local is affected by security vulnerabilities
Published Oct 12, 2026
·Updated
IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding.
Affected Software
5 affected components
IBM Planning Analytics Local=2.0, =2.1
IBM Planning Analytics=2.0
IBM Planning Analytics=2.1
IBM Planning Analytics<=2.0
IBM Planning Analytics<=2.1
Remediation
Information
It is strongly recommended that you apply the most recent security updates:
Affected Product(s)Version(s)FixIBM Planning Analytics Local2.1.0 - 2.1.23 IBM Planning Analytics Local 2.1.24 is now available for download from Fix Central https://w3.ibm.com/w3publisher/capa-release-announcements/2026-releases/pa-2026-releases
IBM Planning Analytics Cloud environment has been remediated.
Patch Available
Event History
Oct 12, 2026
CVE Published
via MITRE·10:40 PM
Data Sourced
via MITRE·10:40 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 15, 2026
Data Sourced
via IBM·10:53 PM
DescriptionAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
The issue is exploitable remotely by an authenticated attacker. Exploitation also requires user interaction.
2
What is the potential impact?
An attacker could execute arbitrary JavaScript because output is not encoded properly. The listed impact includes low confidentiality and integrity impact, with no availability impact.
3
Which product versions are identified as affected?
IBM Planning Analytics versions 2.0 and 2.1 are identified as affected.