{"id":"CVE-2026-19620","published":"2026-10-12T23:17:36.980","lastModified":"2026-10-15T18:15:10.920","description":"IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-288"],"vendors":["ibm"],"products":["planning analytics"],"references":[{"url":"https://www.ibm.com/support/pages/node/7291604","tags":["Patch","Vendor Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"IBM Planning Analytics versions 2.0 and 2.1 contain a flawed authentication mechanism that allows remote attackers to bypass authentication and gain full administrative access to the system. This represents a critical security flaw that could enable attackers to take complete control of planning analytics environments.","exploitability":"Exploitation appears straightforward for remote attackers with minimal prerequisites, requiring only network access to the affected IBM Planning Analytics instances without needing prior authentication credentials.","blast_radius":"If exploited, this vulnerability could allow attackers to access sensitive business planning data, modify critical financial models, and potentially disrupt entire planning processes across organizations using these affected versions.","remediation":"Upgrade to IBM Planning Analytics 2.2 or later to remediate this authentication bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","web","planning-analytics","remote"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:02:42.089Z"}}