CVE-2024-22320criticalobserved exploitationCWE-502

CVE-2024-22320: critical vulnerability in IBM Operational Decision Manager

IBM Operational Decision Manager code execution

Published · Updated

Follow this CVE+ Monitor Operational Decision Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

87Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 73%
from disclosure to weapon
Published on NVDFeb 2
VulnCheck+49d
In short

IBM Operational Decision Manager has a flaw that allows authenticated users to run malicious code on the server by sending specially crafted requests. This happens because the software unsafely processes serialized data, making it a critical security risk.

Technical detail

CVE-2024-22320 is an unsafe deserialization vulnerability (CWE-502) in IBM ODM 8.10.3 that permits authenticated remote attackers to achieve arbitrary code execution with SYSTEM privileges. The attack vector involves sending malicious serialized objects that are deserialized without proper validation, leading to instantiation of attacker-controlled code.

Summary generated and translated by AI from the official description.
IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code in the context of SYSTEM. IBM X-Force ID: 279146.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
IBM · Operational Decision Manager
Related CVEs — IBM Operational Decision Manager

In the same product, most dangerous first.

CVE-2024-22319HIGHIBM Operational Decision Manager JDNI injectionEPSS 76.4%CVE-2026-18658CRITICALIBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressedEPSS 0.8%CVE-2025-2824HIGHIBM Operational Decision Manager HTTP open redirectEPSS 0.4%CVE-2025-1551MEDIUMIBM Operational Decision Manager cross-site scriptingEPSS 0.3%