IBM Planning Analytics: Stack-based buffer overflow allows code execution
Summary
IBM Planning Analytics 2.0 and 2.1 contain a stack-based buffer overflow caused by improper bounds checking. An attacker who can reach the affected service over the network could overflow the buffer and execute arbitrary code on the system. The CVSS vector indicates low attack complexity and low privileges required, with no user interaction.
Affected
- IBM Planning Analytics 2.0
- IBM Planning Analytics 2.1
- Exact affected builds: Unknown.
Fixed in
Unknown. The IBM bulletin 7291604 refers to Planning Analytics Local 2.1.24 for other CVEs; it could not be confirmed that this fix covers CVE-2026-76587. The IBM Cloud environment has been remediated.
Workaround
Unknown. No vendor workaround for this CVE was found.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in CISA KEV.
- No public proof of concept found at the time of research.
Our recommendation
- Read IBM security bulletin 7291604 in full and map the CVE to a fixed build for each installed version (2.0 and 2.1).
- Inventory all Planning Analytics Local and Workspace instances and check whether they are reachable from the internet.
- Restrict access to internal users and VPN, and review user accounts with access.
- Monitor the IBM bulletin, NVD and CISA KEV for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7291604 www.ibm.com
- NVD mirror (Vulners) vulners.com
- KEV and SSVC (OpenCVE) app.opencve.io
- CNA data (Vulners) vulners.com
- CVSS and summary (Strix) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:45.
Original description (NVD)
IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.