CVE-2026-12084: fallo de gravedad media en IBM UCD - IBM DevOps Deploy
IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.3%
IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Productos afectados
IBM · UCD - IBM DevOps DeployCVEs relacionadas — IBM UCD - IBM DevOps Deploy
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-12085MEDIUMIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptable to an Insertion of Sensitive Information Into Sent Data vulnerabilityEPSS 0.4%CVE-2026-78658MEDIUMIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerabilityEPSS 0.4%CVE-2026-10569MEDIUMIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information VulnerabilityEPSS 0.3%CVE-2025-14148MEDIUMIBM DevOps Deploy is susceptible to a Insufficiently Protected Credentials vulnerabilityEPSS 0.3%CVE-2025-13489MEDIUMIBM DevOps Deploy is susceptible to a Cleartext Transmission of Sensitive InformationEPSS 0.2%CVE-2025-36360MEDIUMIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Insufficient Session Expiration vulnerabilityEPSS 0.2%