Actively exploited in the wild

IBM Data Risk Manager Remote Code Execution Vulnerability

IBM - Data Risk Manager · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2020-4428

CriticalCVSS 9.1KEV

Published: 07/05/2020(UTC)Updated: 17/06/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Summary

IBM Data Risk Manager versions 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system.

Risk Assessment

An authenticated attacker can take control of the system by executing arbitrary commands, potentially leading to full compromise of data and infrastructure.

Recommendation

Update IBM Data Risk Manager to the latest version and restrict access to trusted users only.

Other vulnerabilities in IBM Data Risk Manager

CVE-2020-4427CriticalActively exploited
IBM Data Risk Manager versions 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass security restrictions when configured with SAML authentication. By sending a specially crafted HTTP request, an attacker could bypass authentication and gain full administrative access.

Original NVD description (English source)

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533.