What is CVE-2016-0270?

CVE-2016-0270 is a medium-severity vulnerability in IBM Client Application Access, classified under Information Disclosure. CVSS score: 5.9/10. Published 2017-02-08.

How severe is CVE-2016-0270?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Is CVE-2016-0270 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Information disclosure in IBM Client Application Access

CVE-2016-0270

IBM Domino 9.0.1 Fix Pack 3 Interim Fix 2 through 9.0.1 Fix Pack 5 Interim Fix 1, when using TLS and AES GCM, uses random nonce generation, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack." NOTE: this CVE has been incorrectly used for GCM nonce reuse issues in other products; see CVE-2016-10213 for the A10 issue, CVE-2016-10212 for the Radware issue, and CVE-2017-5933 for the Citrix issue.

Vulnerability class: Information Disclosure

Published 2017-02-08 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.031 (87.3th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 87.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.031 · newest: 0.031 · change: 0.000

Affected products

IBM Client Application Access — versions 1.0.0.1
IBM Domino — versions 9.0.1.3, 9.0.1.4, 9.0.1.5
IBM Notes — versions 9.0.1.3, 9.0.1.4, 9.0.1.5

Weakness classification (CWE)

CWE-200 — Information Disclosure

Public proof-of-concept exploits

nonce-disrespect/nonce-disrespect

References

www.securityfocus.com/bid/96062 (VDB Entry, Third Party Advisory, vdb-entry)
www-01.ibm.com/support/docview.wss (Patch, Mitigation, Vendor Advisory)
github.com/nonce-disrespect/nonce-disrespect (Third Party Advisory)
www-01.ibm.com/support/docview.wss (Patch, Mitigation, Vendor Advisory)
support.citrix.com/article/CTX220329
www-01.ibm.com/support/docview.wss (Patch, Mitigation, Vendor Advisory)
www.securitytracker.com/id/1037795 (vdb-entry)

Frequently asked questions

What is CVE-2016-0270?: CVE-2016-0270 is a medium-severity vulnerability in IBM Client Application Access, classified under Information Disclosure. CVSS score: 5.9/10. Published 2017-02-08.
How severe is CVE-2016-0270?: Medium severity. CVSS v3 base score is 5.9 out of 10.
Is CVE-2016-0270 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.