SB2026101914 - Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
Published: October 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
CWE-ID: CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to modify object attributes during deserialization.
The vulnerability exists due to improperly controlled modification of dynamically-determined object attributes in POJO deserialization handling when processing crafted JSON input for properties with a renamed getter and an ignored setter. A remote attacker can supply a renamed JSON key to modify object attributes during deserialization.
This issue occurs with private backing fields retained through property inference, allowing the setter's ignore annotation to be bypassed.
2) Incorrect authorization (CVE-ID: CVE-2026-54517)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass access controls and modify view-restricted properties.
The vulnerability exists due to incorrect authorization in BeanDeserializer._deserializeUsingPropertyBased when deserializing property-based input with setterless collection or map creator properties. A remote attacker can send specially crafted JSON input to bypass access controls and modify view-restricted properties.
Only setterless collection or map properties annotated with a restricted @JsonView and processed under an active view are affected.
Remediation
Install update from vendor's website.