SB2026100607 - Multiple vulnerabilities in IBM Control Center
Published: October 6, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Open redirect (CVE-ID: CVE-2026-47883)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect users to an arbitrary URL.
The vulnerability exists due to an open redirect in UrlHandlerFilter when processing requests with very broadly matching patterns. A remote attacker can craft a request that triggers a redirect to an arbitrary URL to redirect users to an arbitrary URL.
The issue applies to the filter variants in both Spring MVC and Spring WebFlux.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-47885)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper control of resource consumption in PartEventHttpMessageReader when processing multipart request bodies with maxInMemorySize set to -1. A remote attacker can send a specially crafted multipart request to cause a denial of service.
The issue affects controller methods that use an @RequestBody Flux<PartEvent> argument.
3) Sensitive cookie with improper SameSite attribute (CVE-ID: CVE-2026-47889)
CWE-ID: CWE-1275 - Sensitive Cookie with Improper SameSite Attribute
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass sameSite cookie restrictions.
The vulnerability exists due to improper cookie attribute handling in JettyCoreServerHttpResponse when serializing response cookies. A remote attacker can cause an application to issue cookies without the sameSite attribute to bypass sameSite cookie restrictions.
Only WebFlux applications running on the Jetty 12 Core reactive adapter are vulnerable.
4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-47891)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Jaxb2Decoder when parsing XML input with the Aalto XML processor. A remote attacker can send specially crafted XML content to cause a denial of service.
The issue affects Spring WebFlux applications that rely on the Aalto XML processor for XML parsing.
Remediation
Install update from vendor's website.