CVE-2026-9825

Received Received - Intake

Missing Secure Cookie Attribute in IBM Cyber Fraud

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: IBM Corporation

Description

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-9825

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	CyberFraud	1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute on sensitive cookies. This means cookies containing session data are sent over unencrypted HTTP connections instead of encrypted HTTPS connections. Attackers could intercept these cookies via network-based attacks like man-in-the-middle to hijack user sessions.

Impact Analysis

An attacker could capture your session cookies and impersonate you on the IBM Cyber Fraud platform. This may lead to unauthorized access to your account, exposure of sensitive data, or fraudulent transactions if the platform handles financial or personal information.

Compliance Impact

This vulnerability likely violates data protection requirements in GDPR and HIPAA, which mandate encryption for sensitive data transmission. Failure to secure cookies could result in non-compliance, leading to legal penalties, fines, or reputational damage for organizations using the affected software.

Mitigation Strategies

Apply the latest IBM Cyber Fraud update to ensure the secure attribute is added to sensitive cookies. Review and update cookie configurations to enforce secure transmission over encrypted connections only.

Hi! I’m here to help you understand CVE-2026-9825. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70