What is CVE-2026-18658?

CVE-2026-18658 is a critical-severity vulnerability, classified under SQL Injection. CVSS score: 9.8/10. Published 2026-09-04.

How severe is CVE-2026-18658?

Critical severity. CVSS v3 base score is 9.8 out of 10.

CVE-2026-18658

CVE-2026-18658

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.

Vulnerability class: SQL Injection

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Weakness classification (CWE)

CWE-89 — SQL Injection

References

psirt@us.ibm.com

Frequently asked questions

What is CVE-2026-18658?: CVE-2026-18658 is a critical-severity vulnerability, classified under SQL Injection. CVSS score: 9.8/10. Published 2026-09-04.
How severe is CVE-2026-18658?: Critical severity. CVSS v3 base score is 9.8 out of 10.