Multiple Vulnerabilities in IBM Datacap
Priority LOW 24CWE-425Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-425.
Summary
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked in the UI but is accessible by directly requesting the URL, bypassing intended access controls.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00259 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| IBM | Datacap | 9.1.7 – 1.8.4; 9.1.8; 9.1.9 | — | No fix listed | CNA |
| IBM | Datacap Navigator | 9.1.7 – 8.2.1.0; 9.1.8; 9.1.9 | — | No fix listed | CNA |
- Datacap VendorIBM Affected 9.1.7 – 1.8.4; 9.1.8; 9.1.9 Fixed in — No fix listed CNA
- Datacap Navigator VendorIBM Affected 9.1.7 – 8.2.1.0; 9.1.8; 9.1.9 Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ibm:datacap:9.1.7:*:*:*:*:*:*:* | 9.1.7 | Vulnerable | IBM |
| cpe:2.3:a:ibm:datacap:9.1.8:*:*:*:*:*:*:* | 9.1.8 | Vulnerable | IBM |
| cpe:2.3:a:ibm:datacap:9.1.9:*:*:*:*:*:*:* | 9.1.9 | Vulnerable | IBM |
| cpe:2.3:a:ibm:datacap_navigator:9.1.7:*:*:*:*:*:*:* | 9.1.7 | Vulnerable | IBM |
| cpe:2.3:a:ibm:datacap_navigator:9.1.8:*:*:*:*:*:*:* | 9.1.8 | Vulnerable | IBM |
| cpe:2.3:a:ibm:datacap_navigator:9.1.9:*:*:*:*:*:*:* | 9.1.9 | Vulnerable | IBM |
- cpe:2.3:a:ibm:datacap:9.1.7:*:*:*:*:*:*:* Versions 9.1.7 Vulnerable ·IBM
- cpe:2.3:a:ibm:datacap:9.1.8:*:*:*:*:*:*:* Versions 9.1.8 Vulnerable ·IBM
- cpe:2.3:a:ibm:datacap:9.1.9:*:*:*:*:*:*:* Versions 9.1.9 Vulnerable ·IBM
- cpe:2.3:a:ibm:datacap_navigator:9.1.7:*:*:*:*:*:*:* Versions 9.1.7 Vulnerable ·IBM
- cpe:2.3:a:ibm:datacap_navigator:9.1.8:*:*:*:*:*:*:* Versions 9.1.8 Vulnerable ·IBM
- cpe:2.3:a:ibm:datacap_navigator:9.1.9:*:*:*:*:*:*:* Versions 9.1.9 Vulnerable ·IBM
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
IBM Datacap, Datacap Navigator — ibm.com/support/pages/node/7276609
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2026-07592 Multiple Vulnerabilities in IBM DatacapPriority LOW 32
- TI-2026-07102 Multiple Vulnerabilities in IBM DatacapPriority LOW 27
Timeline
- 2026-10-02 Threatist record created from CVE-2026-9610
- 2026-10-03 Alias added: GHSA-gc5m-j868-gqpq
References
More IBM Datacap vulnerabilities
- TI-2024-26657 IBM Datacap Navigator HTTP HOST header injection CVSS 3.1CRITICAL 9.8
- TI-2024-26652 IBM Datacap Navigator information disclosure CVSS 3.1HIGH 7.5
- TI-2026-07592 Multiple Vulnerabilities in IBM Datacap CVSS 3.1HIGH 7.5
- TI-2024-26653 IBM Datacap Navigator information disclosure CVSS 3.1HIGH 7.5
- TI-2024-26649 IBM Datacap Navigator cross-site scripting CVSS 3.1MEDIUM 6.4
- TI-2026-07102 Multiple Vulnerabilities in IBM Datacap CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-9610 · CVE Program
- CVE-2026-9610 · NVD
- FIRST EPSS
- GHSA-gc5m-j868-gqpq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences