Read the docs
TI-2022-21351 Aliases CVE-2022-43574GHSA-p85m-rcvw-2rv6

Incorrect default permissions in IBM Robotic Process Automation

Priority MEDIUM 40CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

"IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to application configurations. IBM X-Force ID: 238679."

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00557 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—IBM Robotic Process Automation"21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5"—No fix listedCNA
  • IBM Robotic Process Automation Vendor— Affected "21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5" Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:*before 21.0.6VulnerableIBM
cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:*before 21.0.6VulnerableIBM
  • cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:* Versions before 21.0.6 Vulnerable ·IBM
  • cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:* Versions before 21.0.6 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-43574
  2. 2026-10-03 Alias added: GHSA-p85m-rcvw-2rv6
  3. 2026-11-01 Priority changed: LOW → MEDIUM

References

Patch 1

  • TI-2023-20075 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
  • TI-2022-06718 SQL injection in IBM Robotic Process Automation CVSS 3.1CRITICAL 9.8
  • TI-2023-23069 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
  • TI-2022-18554 Insufficiently protected credentials in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
  • TI-2022-06782 IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that… CVSS 3.1HIGH 7.5
  • TI-2022-06728 Improper input validation in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences