{"id":"CVE-2026-114464","published":"2026-11-08T17:16:36.583","lastModified":"2026-11-09T20:18:04.490","description":"IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://www.ibm.com/support/pages/node/7294875","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Process Mining versions 2.0.0 through 2.2.1 suffer from improper access control, allowing a remote attacker with network access to view sensitive data without authentication or authorization. This flaw enables unauthorized disclosure of potentially confidential process mining information.","exploitability":"Exploitation requires only network access to the affected system and no prior authentication or user interaction, making it highly exploitable by remote attackers.","blast_radius":"Successful exploitation could expose sensitive operational data, including business process models, logs, or metrics, potentially impacting confidentiality across the organization's process mining environment.","remediation":"Upgrade to IBM Process Mining 2.3.0 or later, as this version includes the fix for CVE-2026-114464.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","info-disclosure","web","network"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:44:50.383Z"}}