Actively exploited in the wild

IBM Planning Analytics Remote Code Execution Vulnerability

IBM - Planning Analytics · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2019-4716

CriticalCVSS 9.8KEV

Published: 18/12/2019(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as 'admin', and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.

Risk Assessment

Critical risk of system takeover by an unauthenticated attacker, with potential to execute code with root/SYSTEM privileges.

Recommendation

Update IBM Planning Analytics to the latest patched version.

Other vulnerabilities in IBM Planning Analytics

CVE-2026-13365High
IBM Planning Analytics 2.0 and 2.1 Local is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Original NVD description (English source)

IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.