CVE-2026-93005: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026

Q: Who can exploit this issue?

An attacker must be authenticated to IBM Process Mining. The provided information does not indicate that unauthenticated users can trigger the excessive-email condition.

Q: What is the practical impact?

An authenticated attacker can exploit insufficient rate limiting on email notifications to send excessive emails to targeted recipients, causing a denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact.

Q: Which versions are identified as affected?

IBM Process Mining versions 2.0.0 through 2.2.1 are identified as affected.

Published Oct 30, 2026

Updated

IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients.

Other sources

IBM Process Mining could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulting in excessive emails being sent to targeted recipients.

— IBM

Affected Software

1 affected componentFixes available

IBM Process Mining<=2.0.0 - 2.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade IBM Process Mining to a version that resolves this vulnerability.
Fixed in 2.2.1Patch IF001
Operational
Open an IBM Support Portal case for IBM Process Mining and reference the published security advisory so the interim fix can be delivered through the support case.

Event History

Oct 30, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Nov 8, 2026

CVE Published

via MITRE·06:46 PM

Data Sourced

via MITRE·06:46 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7294875

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to IBM Process Mining. The provided information does not indicate that unauthenticated users can trigger the excessive-email condition.

What is the practical impact?

An authenticated attacker can exploit insufficient rate limiting on email notifications to send excessive emails to targeted recipients, causing a denial of service. The supplied CVSS vector indicates no confidentiality or integrity impact.

Which versions are identified as affected?

IBM Process Mining versions 2.0.0 through 2.2.1 are identified as affected.

CVE-2026-93005: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

Which versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

Which versions are identified as affected?