SB2026092319 - Multiple vulnerabilities in IBM Optim
Published: September 23, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-27587)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass path-based routing and access controls.
The vulnerability exists due to improper access control in the MatchPath path request matcher when processing request paths containing percent-escape sequences. A remote attacker can send a specially crafted request path with altered casing to bypass path-based routing and access controls.
Exploitation requires a deployment that uses path matchers with %xx patterns to protect sensitive endpoints, and the issue can lead to unauthorized access depending on upstream configuration.
2) Improper access control (CVE-ID: CVE-2026-27588)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-based routing and access controls.
The vulnerability exists due to improper access control in the MatchHost host request matcher when handling requests with modified Host header casing in large host lists. A remote attacker can send a specially crafted request with altered Host header casing to bypass host-based routing and access controls.
Only configurations using host matchers with more than 100 entries are affected.
Remediation
Install update from vendor's website.