TIBCO Enterprise Message Service Windows Platform Artifact Search vulnerability
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-427.
Summary
The Enterprise Message Service Server (tibemsd), Enterprise Message Service Central Administration (tibemsca), Enterprise Message Service JSON configuration generator (tibemsconf2json), and Enterprise Message Service C API components of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Message Service: versions 8.5.1 and below, TIBCO Enterprise Message Service - Community Edition: versions 8.5.1 and below, and TIBCO Enterprise Message Service - Developer Edition: versions 8.5.1 and below.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TIBCO | TIBCO Enterprise Message Service | up to 8.5.1 | — | No fix listed | CNA |
| TIBCO | TIBCO Enterprise Message Service - Community Edition | up to 8.5.1 | — | No fix listed | CNA |
| TIBCO | TIBCO Enterprise Message Service - Developer Edition | up to 8.5.1 | — | No fix listed | CNA |
- TIBCO Enterprise Message Service VendorTIBCO Affected up to 8.5.1 Fixed in — No fix listed CNA
- TIBCO Enterprise Message Service - Community Edition VendorTIBCO Affected up to 8.5.1 Fixed in — No fix listed CNA
- TIBCO Enterprise Message Service - Developer Edition VendorTIBCO Affected up to 8.5.1 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tibco:enterprise_message_service:*:*:-:*:*:*:*:* | up to 8.5.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:enterprise_message_service:*:*:community:*:*:*:*:* | up to 8.5.1 | Vulnerable | TIBCO |
| cpe:2.3:a:tibco:enterprise_message_service:*:*:developer:*:*:*:*:* | up to 8.5.1 | Vulnerable | TIBCO |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:tibco:enterprise_message_service:*:*:-:*:*:*:*:* Versions up to 8.5.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:enterprise_message_service:*:*:community:*:*:*:*:* Versions up to 8.5.1 Vulnerable ·TIBCO
- cpe:2.3:a:tibco:enterprise_message_service:*:*:developer:*:*:*:*:* Versions up to 8.5.1 Vulnerable ·TIBCO
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28822
- 2026-10-03 Alias added: GHSA-xpvq-rpfc-g9rw
References
More TIBCO Enterprise Message Service vulnerabilities
- TI-2009-01226 Stack-based buffer overflow in TIBCO SmartSockets before 6.8.2, SmartSockets Product… CVSS 2.0HIGH 10.0
- TI-2007-05438 Heap-based buffer overflow in TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks… CVSS 2.0HIGH 10.0
- TI-2008-01633 Multiple buffer overflows in TIBCO Software Enterprise Message Service (EMS) before… CVSS 2.0HIGH 10.0
- TI-2007-05437 TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise… CVSS 2.0HIGH 10.0
- TI-2007-05436 TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise… CVSS 2.0HIGH 10.0
- TI-2007-05435 TIBCO SmartSockets RTserver 6.8.0 and earlier, RTworks before 4.0.4, and Enterprise… CVSS 2.0HIGH 10.0
Sources
- CVE-2021-28822 · CVE Program
- CVE-2021-28822 · NVD
- FIRST EPSS
- GHSA-xpvq-rpfc-g9rw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences