Read the docs
TI-2024-33277 Aliases CVE-2024-49824GHSA-vcxw-vmr7-hmxx

IBM Robotic Process Automation security bypass

Priority LOW 29CWE-602Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

IBM Robotic Process Automation 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.18 and 23.0.0 through 23.0.18 could allow an authenticated user to perform unauthorized actions as a privileged user due to improper validation of client-side security enforcement.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMRobotic Process Automation21.0.0 – 21.0.7.18; 23.0.0 – 23.0.18—No fix listedCNA
IBMRobotic Process Automation for Cloud Pak21.0.0 – 21.0.7.18; 23.0.0 – 23.0.18—No fix listedCNA
  • Robotic Process Automation VendorIBM Affected 21.0.0 – 21.0.7.18; 23.0.0 – 23.0.18 Fixed in — No fix listed CNA
  • Robotic Process Automation for Cloud Pak VendorIBM Affected 21.0.0 – 21.0.7.18; 23.0.0 – 23.0.18 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:*21.0.0 to before 21.0.7.19; 23.0.0 to before 23.0.19VulnerableIBM
cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:*21.0.0 to before 21.0.7.19; 23.0.0 to before 23.0.19VulnerableIBM
  • cpe:2.3:a:ibm:robotic_process_automation:*:*:*:*:*:*:*:* Versions 21.0.0 to before 21.0.7.19; 23.0.0 to before 23.0.19 Vulnerable ·IBM
  • cpe:2.3:a:ibm:robotic_process_automation_for_cloud_pak:*:*:*:*:*:*:*:* Versions 21.0.0 to before 21.0.7.19; 23.0.0 to before 23.0.19 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-49824
  2. 2026-10-03 Alias added: GHSA-vcxw-vmr7-hmxx

References

Advisory 1

  • TI-2023-20075 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
  • TI-2022-06718 SQL injection in IBM Robotic Process Automation CVSS 3.1CRITICAL 9.8
  • TI-2023-23069 IBM Robotic Process Automation privilege escalation CVSS 3.1CRITICAL 9.8
  • TI-2022-21351 Incorrect default permissions in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
  • TI-2022-18554 Insufficiently protected credentials in IBM Robotic Process Automation CVSS 3.1HIGH 7.5
  • TI-2022-06782 IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that… CVSS 3.1HIGH 7.5
See all 45 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences