CVE-2026-8636
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allow an attacker to retrieve user passwords and cryptographic keys from memory. The attacker can use the same keys to decrypt passwords, gain access to the application, and access sensitive data in the database.
Risk Assessment
The risk for the organization is the potential takeover of user accounts and access to confidential data stored in the database, which may lead to a breach of confidentiality and system integrity.
Recommendation
It is recommended to immediately update IBM Datacap and IBM Datacap Navigator to the latest available version that fixes this vulnerability, and restrict access to process memory to trusted users only.
Other vulnerabilities in IBM Datacap 9.1.7, 9.1.8, 9.1.9; IBM Datacap Navigator 9.1.7, 9.1.8, 9.1.9
See all- CVE-2026-9610Low
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 expose resources or functionality that isn't linked in the UI but is accessible by directly requesting the URL, bypassing intended access controls.
- CVE-2026-8059Medium
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 are vulnerable to cross-site scripting (XSS). An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.
Original NVD description (English source)
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database.