{"affected":[{"product":"Optim","source":"CNA: ibm","vendor":"IBM","versions":[{"status":"affected","version":"1.0.0"},{"status":"affected","version":"1.1.0"},{"status":"affected","version":"1.2.0"}]}],"cveId":"CVE-2026-17466","cwes":["CWE-22"],"description":"IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.1,"severity":"critical","source":"CNA: ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","version":"3.1"}],"modifiedAt":1794160299935,"publishedAt":1794160299935,"references":[{"source":"CNA: ibm","tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7289719"}],"remediation":[{"kind":"fix","source":"CNA: ibm","text":"IBM strongly recommends addressing the vulnerability now.\n\n\n\nMove to IBM Optim Test Data Management 2.0.0 IBM Optim Test Data Management 2.0.0 resolves all three vulnerabilities.\n\n\n\nFile Path Traversal (ID: 218782) — The application now validates that file paths requested by users stay within the permitted directory. Any request attempting to access files outside that boundary is rejected.\n\n\n\nNo Rate Limit (ID: 218776) — The application now enforces request rate limits per user on protected endpoints and per IP address on login endpoints. Requests that exceed the limit are blocked until the rate drops back within bounds.\n\n\n\nWeak Password Policy (ID: 218648) — Default accounts and passwords have been removed. A unique administrator password is now generated automatically during installation.\n\n\nAvailable from  https://www.ibm.com/software/passportadvantage/pao-customer"},{"kind":"fix","source":"CNA: ibm","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://www.ibm.com/support/pages/node/7289719"}],"revision":"cdb0c1881aba7e1ec4a7f0e10a8dfa7310d8a8498627d9cec843d80aae5fd559","sources":[{"modifiedAt":1794160299935,"name":"CNA: ibm","retrievedAt":1794161337003,"url":"https://www.cve.org/CVERecord?id=CVE-2026-17466"}],"ssvc":null,"status":"published","title":"IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities","updatedAt":1794161337003}