CVE-2026-18658: critical vulnerability in IBM Operational Decision Manager
IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.8%
IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
IBM · Operational Decision ManagerRelated CVEs — IBM Operational Decision Manager
In the same product, most dangerous first.
CVE-2024-22319HIGHIBM Operational Decision Manager JDNI injectionEPSS 76.4%CVE-2024-22320CRITICALIBM Operational Decision Manager code executionEPSS 73.4%CVE-2025-2824HIGHIBM Operational Decision Manager HTTP open redirectEPSS 0.4%CVE-2025-1551MEDIUMIBM Operational Decision Manager cross-site scriptingEPSS 0.3%