Read the docs
TI-2018-01404 Aliases CVE-2018-1547GHSA-2hgx-m265-x6jf

IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote…

Priority LOW 39Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA.

Summary

IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security questions, an attacker could exploit this vulnerability to run any command or program on the victim's machine. IBM X-Force ID: 142651.

Why it matters now

EPSS 0.01966 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMRobotic Process Automation with Automation Anywhere10.0—No fix listedCNA
  • Robotic Process Automation with Automation Anywhere VendorIBM Affected 10.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ibm:robotic_process_automation_with_automation_anywhere:10.0:*:*:*:*:*:*:*10.0VulnerableIBM
  • cpe:2.3:a:ibm:robotic_process_automation_with_automation_anywhere:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1547
  2. 2026-10-03 Alias added: GHSA-2hgx-m265-x6jf

References

Patch 1

  • TI-2019-03222 Missing brute-force protection in IBM Robotic Process Automation with Automation Anywhere CVSS 3.1CRITICAL 9.8
  • TI-2018-01409 Unrestricted file upload in IBM Robotic Process Automation with Automation Anywhere CVSS 3.0HIGH 8.8
  • TI-2018-01381 Cross-site request forgery in IBM Robotic Process Automation with Automation Anywhere CVSS 3.0HIGH 8.8
  • TI-2018-01638 Cleartext storage of sensitive information in IBM Robotic Process Automation with… CVSS 3.0HIGH 7.8
  • TI-2020-04130 IBM Robotic Process Automation with Automation Anywhere 11.0 could allow an attacker on… CVSS 3.1MEDIUM 6.5
  • TI-2019-03198 IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged… CVSS 3.1HIGH 7.1
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences