SB2026100610 - Multiple vulnerabilities in IBM Control Center

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026100610

SB2026100610 - Multiple vulnerabilities in IBM Control Center

Published: October 6, 2026

Security Bulletin ID SB2026100610
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Path traversal (CVE-ID: CVE-2026-47884)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper path limitation in XsltView when rendering views through a catch-all "/**" mapping without an explicitly specified view name. A remote attacker can send a specially crafted request to execute arbitrary code.

The issue can also lead to server-side request forgery.


2) Open redirect (CVE-ID: CVE-2026-47887)

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to redirect users to an arbitrary URL.

The vulnerability exists due to an open redirect in UrlFileNameViewController when processing requests in applications where it is mapped with an end-of-path and no prefix is configured. A remote attacker can send a specially crafted request to redirect users to an arbitrary URL.


3) CRLF injection (CVE-ID: CVE-2026-47890)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to corrupt the stream of data sent to other users.

The vulnerability exists due to improper neutralization of carriage return line feeds in server-sent event view fragment rendering when streaming attacker-controlled data to clients over server-sent events. A remote user can control data that is streamed to other users to corrupt the stream of data sent to other users.

Exploitation requires the application to use Spring MVC or Spring WebFlux and send view fragments to clients over server-sent events.


Remediation

Install update from vendor's website.

References