SB2026102052 - Multiple vulnerabilities in Automation Assets in IBM Integration
Published: October 20, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-84292)
CWE-ID: CWE-116 - Improper Encoding or Escaping of Output
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect URI authority to an attacker-controlled host.
The vulnerability exists due to improper encoding or escaping of output in the authority recomposition logic when serializing a URI with an unvalidated port component. A remote attacker can supply a non-digit port value containing authority delimiters to redirect URI authority to an attacker-controlled host.
The issue is reachable through the object forms of serialize(), normalize(), and equal(). A port value obtained from parse() is always digits and is not affected.
2) Interpretation Conflict (CVE-ID: CVE-2026-84394)
CWE-ID: CWE-436 - Interpretation Conflict
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host-based security decisions.
The vulnerability exists due to interpretation conflict in URI authority host parsing when processing a URL containing an unclosed or misplaced bracket in the authority. A remote attacker can supply a specially crafted URL to bypass host-based security decisions.
This issue can occur when an application evaluates policy using the parsed host value and then sends the original URL through an HTTP client that resolves the host differently.
3) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-86472)
CWE-ID: CWE-178 - Improper Handling of Case Sensitivity
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass host allowlist or denylist checks.
The vulnerability exists due to improper handling of case sensitivity in the fast-uri host parsing, normalization, and equality functions when processing scheme-relative references containing percent-encoded uppercase unreserved host octets. A remote attacker can supply a crafted scheme-relative URL to bypass host allowlist or denylist checks.
The evading hostname resolves and routes to the same host intended to be restricted.
Remediation
Install update from vendor's website.