IBM Planning Analytics: Authentication bypass leads to unauthorized admin access
Summary
IBM Planning Analytics 2.0 and 2.1 contain an improper authentication flaw that allows a remote attacker to gain unauthorized administrative access. According to the NVD, the attack requires low privileges, so an attacker with any valid user account may be able to reach administrative functions. IBM and NVD rate the vulnerability 8.8 (High), with full impact on confidentiality, integrity and availability.
Affected
- IBM Planning Analytics 2.0
- IBM Planning Analytics 2.1
Fixed in
- IBM Planning Analytics Local 2.1.x: upgrade to 2.1.24 (available via IBM Fix Central)
- IBM Planning Analytics Local 2.0: Unknown. Obtain the fix from IBM support before planning an upgrade.
Workaround
Unknown. No vendor workaround has been identified. Until the fix is applied, restrict network access to Planning Analytics servers and review administrative accounts.
Exploitation
- No known exploitation in the wild; not listed in the CISA KEV catalog at the time of research.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- No public proof-of-concept found; this does not prove that none exists.
Our recommendation
- Confirm the exact installed version (2.0 or 2.1.x).
- Upgrade 2.1.x installations to 2.1.24 soon and obtain the 2.0 fix from IBM.
- Restrict access to Planning Analytics and Workspace to internal networks or VPN.
- Review administrative accounts and monitor logs for unexpected administrative activity.
- Check whether the related issue CVE-2026-19622 in the same product also needs patching.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin (primary advisory) www.ibm.com
- Strix CVE-2026-19620 www.strix.ai
- VulDB 417299 vuldb.com
- Vulners VulnCheck record CVE-2026-19620 vulners.com
- HOL Guard CVE-2026-19620 hol.org
- ThreatInt CVE-2026-19620 cve.threatint.com
- The Hacker Wire CVE-2026-19620 www.thehackerwire.com
- Strix CVE-2026-19622 (related issue) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:18.
Original description (NVD)
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.