Improper Access Control in IBM CICS Gateway Allows File Exposure

Executive Summary

The CVE-2026-0977 vulnerability affects IBM CICS Transaction Gateway for Multiplatforms versions 9.3 and 10.1. It is caused by improper access controls, which could allow a user to transfer or view files without proper authorization.

This means that someone with local access to the system might be able to access or move files they should not have permission to, due to insufficient restrictions on file access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to view or transfer files, potentially leading to a loss of confidentiality and integrity of your data.

Since the vulnerability requires local access and has low attack complexity, an attacker with local access could exploit it without needing special privileges or user interaction.

The impact does not affect system availability but could compromise sensitive information and data integrity.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

There are no specific detection commands or methods provided for identifying this vulnerability on your network or system.

The vulnerability affects IBM CICS Transaction Gateway for Multiplatforms versions 9.3 and 10.1 due to improper access controls allowing unauthorized file transfer or viewing.

Detection would likely involve verifying the version of the CICS Transaction Gateway in use and checking for proper access control configurations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, IBM recommends configuring appropriate egress and ingress network policies at the POD or HOST level.

Detailed remediation instructions are available in the official CICS Transaction Gateway for Multiplatforms documentation for versions 9.3 and 10.1.

No specific workarounds or alternative mitigations beyond these configuration changes are noted.

Useful 0 Not Useful 0