SB20260731164 - Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260731164

SB20260731164 - Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services

Published: July 31, 2026

Security Bulletin ID SB20260731164
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 40% Medium 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Deserialization of Untrusted Data (CVE-ID: CVE-2026-54512)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to instantiate arbitrary classes.

The vulnerability exists due to deserialization of untrusted data in DatabindContext._resolveAndValidateGeneric() and PolymorphicTypeValidator handling when processing polymorphic type identifiers with generic parameters during deserialization. A remote attacker can supply a specially crafted type identifier and JSON data to instantiate arbitrary classes.

Only applications that accept untrusted JSON and have polymorphic typing enabled while relying on a configured PolymorphicTypeValidator allow-list are affected.


2) Incomplete List of Disallowed Inputs (CVE-ID: CVE-2026-54513)

CWE-ID: CWE-184 - Incomplete List of Disallowed Inputs

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to instantiate non-allowlisted types.

The vulnerability exists due to incomplete list of disallowed inputs in BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() when deserializing attacker-controlled JSON containing array subtypes. A remote attacker can supply a crafted array wrapper to instantiate non-allowlisted types.

The issue occurs because array types are allowlisted based only on whether the class is an array, without validating the array component type against the configured allowlist, and no further validator check occurs for elements when per-element type IDs are absent.


3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-54514)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause outbound DNS requests and disclose limited network information.

The vulnerability exists due to server-side request forgery in JDKFromStringDeserializer when deserializing untrusted JSON into a type containing an InetSocketAddress field. A remote attacker can supply a crafted hostname value to cause outbound DNS requests and disclose limited network information.

The DNS lookup occurs during readValue before application-level validation or explicit connection logic.


4) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: CVE-2026-54515)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to modify otherwise ignored object attributes.

The vulnerability exists due to improper control of dynamically determined object attributes in BeanDeserializerBase.createContextual() when processing case-insensitive deserialization with per-property @JsonIgnoreProperties exclusions. A remote attacker can send crafted JSON input to modify otherwise ignored object attributes.

Only applications that enable case-insensitive property matching and rely on per-property @JsonIgnoreProperties to keep a field unwritable are vulnerable.


5) Improperly Controlled Modification of Dynamically-Determined Object Attributes (CVE-ID: CVE-2026-59888)

CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to modify dynamically determined object attributes.

The vulnerability exists due to improper control of dynamically determined object attributes in jackson-databind record deserialization when applying a PropertyNamingStrategy to `@JsonIgnore`-annotated Record properties. A remote attacker can supply a specially crafted JSON key to modify dynamically determined object attributes.

This issue affects Java Records during deserialization when a naming strategy is used and `@JsonIgnore` is relied on to prevent a component from being set from input.


Remediation

Install update from vendor's website.

References