Improper Handling of Windows Device Names in Werkzeug - CVE-2026-27199

Vulnerability identifier: #VU123124

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-27199

CWE-ID: CWE-67

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the "safe_join" function allows Windows device names as filenames if when preceded by other path segments. A remote attacker can cause reading of the file to hang indefinitely.

Werkzeug
IBM Cloud Pak for Data System
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Application Suite
IBM Cloud Object Storage Systems
Storage Defender - Resiliency Service
watsonx Code Assistant On Prem
Maximo Application Suite - IoT Component
Maximo Application Suite Ai Service
Maximo Scheduler Optimizer
Storage Protect Plus Server
Robotic Process Automation for Cloud Pak
IBM InfoSphere Information Server

Install updates from vendor's website.

Werkzeug - update to 3.1.6
IBM Cloud Pak for Data System - update to 8.10.26.06.SP2
Storage Defender - Resiliency Service - update to 2.1.3
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.2
watsonx Code Assistant On Prem - update to 5.3.1
Maximo Application Suite - IoT Component - addressed in versions 8.7.32, 8.8.29, 9.0.18, 9.1.9
IBM Maximo Application Suite - addressed in versions 8.10.36, 8.11.33, 9.0.22, 9.1.11
Maximo Application Suite Ai Service - update to 9.1.13
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 3
IBM Cloud Object Storage Systems - addressed in versions 3.20.0.43, 3.20.0.69
Maximo Scheduler Optimizer - addressed in versions 8.4.28, 8.5.28, 9.0.22, 9.1.11
Storage Protect Plus Server - update to 10.1.18
Robotic Process Automation for Cloud Pak - addressed in versions 23.0.20.6, 30.0.2

• https://github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x

• Improper Handling of Windows Device Names in Werkzeug
• Multiple vulnerabilities in IBM watsonx Code Assistant On Prem
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Multiple vulnerabilities in IBM Storage Protect Plus Server
• Multiple vulnerabilities in IBM Maximo Application Suite
• IBM Maximo AI Service update for Werkzeug
• Multiple vulnerabilities in IBM Storage Defender - Resiliency Service
• IBM Watson Discovery Cartridge update for Werkzeug
• IBM Maximo Scheduler Optimizer update for Werkzeug
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Cloud Object System
• IBM InfoSphere Information Server update for Werkzeug
• IBM Cloud Pak for Data System update for Werkzeug