Vulnerability-Lookup

CVE-2025-14806 (GCVE-0-2025-14806)

Vulnerability from cvelistv5 – Published: 2026-03-17 21:50 – Updated: 2026-03-18 14:49

Title

IBM Planning Analytics Information Disclosure

Summary

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.

Severity

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-524 - Use of Cache Containing Sensitive Information

Assigner

ibm

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7263581	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	Planning Analytics Local	Affected: 2.1.0 , ≤ 2.1.17 (semver) cpe:2.3:a:ibm:planning_analytics_local:2.1.0:::::::* cpe:2.3:a:ibm:planning_analytics_local:2.1.17:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-14806",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-18T14:48:56.000875Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-18T14:49:19.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:planning_analytics_local:2.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:planning_analytics_local:2.1.17:*:*:*:*:*:*:*"
          ],
          "product": "Planning Analytics Local",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "2.1.17",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.\u003c/p\u003e"
            }
          ],
          "value": "IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-524",
              "description": "CWE-524 Use of Cache Containing Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-17T21:50:21.639Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7263581"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRemediation/Fixes It is strongly recommended that you apply the most recent security updates: Affected Product(s) Version(s) Fix IBM Planning Analytics Local 2.1.0 - 2.1.17 IBM Planning Analytics Local 2.1.18 is now available for download from Fix Central IBM Planning Analytics Cloud environment has been remediated.\u003c/p\u003e"
            }
          ],
          "value": "Remediation/Fixes It is strongly recommended that you apply the most recent security updates: Affected Product(s) Version(s) Fix IBM Planning Analytics Local 2.1.0 - 2.1.17 IBM Planning Analytics Local 2.1.18 is now available for download from Fix Central IBM Planning Analytics Cloud environment has been remediated."
        }
      ],
      "title": "IBM Planning Analytics Information Disclosure",
      "x_generator": {
        "engine": "ibm-cvegen"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-14806",
    "datePublished": "2026-03-17T21:50:21.639Z",
    "dateReserved": "2025-12-16T22:13:03.714Z",
    "dateUpdated": "2026-03-18T14:49:19.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-14806",
      "date": "2026-07-09",
      "epss": "0.00292",
      "percentile": "0.2101"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-14806\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2026-03-17T22:16:13.903\",\"lastModified\":\"2026-06-17T08:36:34.820\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.\"},{\"lang\":\"es\",\"value\":\"IBM Planning Analytics Local 2.1.0 hasta 2.1.17 podr\u00eda permitir a un atacante enga\u00f1ar al mecanismo de cach\u00e9 para que almacene y sirva respuestas sensibles y espec\u00edficas del usuario como recursos p\u00fablicamente almacenables en cach\u00e9.\"}],\"affected\":[{\"source\":\"psirt@us.ibm.com\",\"affectedData\":[{\"vendor\":\"IBM\",\"product\":\"Planning Analytics Local\",\"cpes\":[\"cpe:2.3:a:ibm:planning_analytics_local:2.1.0:*:*:*:*:*:*:*\",\"cpe:2.3:a:ibm:planning_analytics_local:2.1.17:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"2.1.0\",\"lessThanOrEqual\":\"2.1.17\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.1,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-18T14:48:56.000875Z\",\"id\":\"CVE-2025-14806\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-524\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:planning_analytics_local:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.1.0\",\"versionEndExcluding\":\"2.1.18\",\"matchCriteriaId\":\"43E47EAC-8441-44FC-898B-AFFA578AAE37\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7263581\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-03-27T08:58:44+00:00",
      "cve": "CVE-2025-14806",
      "id": "CVE-2025-14806",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "IBM Planning Analytics Information Disclosure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-14806.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-14806\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-18T14:48:56.000875Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-18T14:49:12.236Z\"}}], \"cna\": {\"title\": \"IBM Planning Analytics Information Disclosure\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:ibm:planning_analytics_local:2.1.0:*:*:*:*:*:*:*\", \"cpe:2.3:a:ibm:planning_analytics_local:2.1.17:*:*:*:*:*:*:*\"], \"vendor\": \"IBM\", \"product\": \"Planning Analytics Local\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.1.17\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Remediation/Fixes It is strongly recommended that you apply the most recent security updates: Affected Product(s) Version(s) Fix IBM Planning Analytics Local 2.1.0 - 2.1.17 IBM Planning Analytics Local 2.1.18 is now available for download from Fix Central IBM Planning Analytics Cloud environment has been remediated.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eRemediation/Fixes It is strongly recommended that you apply the most recent security updates: Affected Product(s) Version(s) Fix IBM Planning Analytics Local 2.1.0 - 2.1.17 IBM Planning Analytics Local 2.1.18 is now available for download from Fix Central IBM Planning Analytics Cloud environment has been remediated.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7263581\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"x_generator\": {\"engine\": \"ibm-cvegen\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-524\", \"description\": \"CWE-524 Use of Cache Containing Sensitive Information\"}]}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2026-03-17T21:50:21.639Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-14806\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-18T14:49:19.048Z\", \"dateReserved\": \"2025-12-16T22:13:03.714Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2026-03-17T21:50:21.639Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-14806

Vulnerability from fkie_nvd - Published: 2026-03-17 22:16 - Updated: 2026-06-17 08:36

Severity

5.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Summary

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.

References

	URL	Tags
	psirt@us.ibm.com	https://www.ibm.com/support/pages/node/7263581	Vendor Advisory

Impacted products

	Vendor	Product	Version
	ibm	planning_analytics_local	*
	microsoft	windows	-

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:planning_analytics_local:2.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:planning_analytics_local:2.1.17:*:*:*:*:*:*:*"
          ],
          "product": "Planning Analytics Local",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "2.1.17",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:planning_analytics_local:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "43E47EAC-8441-44FC-898B-AFFA578AAE37",
              "versionEndExcluding": "2.1.18",
              "versionStartIncluding": "2.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources."
    },
    {
      "lang": "es",
      "value": "IBM Planning Analytics Local 2.1.0 hasta 2.1.17 podr\u00eda permitir a un atacante enga\u00f1ar al mecanismo de cach\u00e9 para que almacene y sirva respuestas sensibles y espec\u00edficas del usuario como recursos p\u00fablicamente almacenables en cach\u00e9."
    }
  ],
  "id": "CVE-2025-14806",
  "lastModified": "2026-06-17T08:36:34.820",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.6,
        "source": "psirt@us.ibm.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-14806",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-03-18T14:48:56.000875Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-03-17T22:16:13.903",
  "references": [
    {
      "source": "psirt@us.ibm.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.ibm.com/support/pages/node/7263581"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-524"
        }
      ],
      "source": "psirt@us.ibm.com",
      "type": "Secondary"
    }
  ]
}

GHSA-FWJ3-7PPR-QCV6

Vulnerability from github – Published: 2026-03-18 00:30 – Updated: 2026-03-18 00:30

Details

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.

Severity

5.7 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-14806"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-524"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-17T22:16:13Z",
    "severity": "MODERATE"
  },
  "details": "IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources.",
  "id": "GHSA-fwj3-7ppr-qcv6",
  "modified": "2026-03-18T00:30:54Z",
  "published": "2026-03-18T00:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14806"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7263581"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-0759

Vulnerability from csaf_certbund - Published: 2026-03-17 23:00 - Updated: 2026-03-17 23:00

Summary

IBM Planning Analytics: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: IBM Planning Analytics ist eine Softwarelösung für Unternehmensplanung und -analyse, die Budgetierung, Forecasting und Reporting unterstützt.

Angriff: Ein Angreifer kann mehrere Schwachstellen in IBM Planning Analytics ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

Betroffene Betriebssysteme: - Linux - UNIX - Windows

CVE-2025-14874

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
IBM Planning Analytics <2.1.18 IBM / Planning Analytics		<2.1.18

CVE-2025-15284

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
IBM Planning Analytics <2.1.18 IBM / Planning Analytics		<2.1.18

CVE-2025-61729

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
IBM Planning Analytics <2.1.18 IBM / Planning Analytics		<2.1.18

CVE-2025-14806

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
IBM Planning Analytics <2.1.18 IBM / Planning Analytics		<2.1.18

CVE-2026-1267

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
IBM Planning Analytics <2.1.18 IBM / Planning Analytics		<2.1.18

CVE-2025-61727

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
IBM Planning Analytics <2.1.18 IBM / Planning Analytics		<2.1.18

References

4 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.ibm.com/support/pages/node/7263581	external
https://github.com/advisories/GHSA-rcmh-qjqh-p98v	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM Planning Analytics ist eine Softwarel\u00f6sung f\u00fcr Unternehmensplanung und -analyse, die Budgetierung, Forecasting und Reporting unterst\u00fctzt.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in IBM Planning Analytics ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0759 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0759.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0759 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0759"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin vom 2026-03-17",
        "url": "https://www.ibm.com/support/pages/node/7263581"
      },
      {
        "category": "external",
        "summary": "Github Advisory vom 2025-11-27 mit PoC",
        "url": "https://github.com/advisories/GHSA-rcmh-qjqh-p98v"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM Planning Analytics: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-03-17T23:00:00.000+00:00",
      "generator": {
        "date": "2026-03-18T10:53:05.398+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0759",
      "initial_release_date": "2026-03-17T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-03-17T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.1.18",
                "product": {
                  "name": "IBM Planning Analytics \u003c2.1.18",
                  "product_id": "T051806"
                }
              },
              {
                "category": "product_version",
                "name": "2.1.18",
                "product": {
                  "name": "IBM Planning Analytics 2.1.18",
                  "product_id": "T051806-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:planning_analytics:2.1.18"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Planning Analytics"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14874",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2025-14874"
    },
    {
      "cve": "CVE-2025-15284",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2025-15284"
    },
    {
      "cve": "CVE-2025-61729",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2025-61729"
    },
    {
      "cve": "CVE-2025-14806",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2025-14806"
    },
    {
      "cve": "CVE-2026-1267",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2026-1267"
    },
    {
      "cve": "CVE-2025-61727",
      "product_status": {
        "known_affected": [
          "T051806"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2025-61727"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-14806 (GCVE-0-2025-14806)

FKIE_CVE-2025-14806

GHSA-FWJ3-7PPR-QCV6

WID-SEC-W-2026-0759

Tags

Sightings

Nomenclature