CVE-2026-17475

Received Received - Intake

Remote Folder Deletion in IBM Planning Analytics

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: IBM Corporation

Description

IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to delete folders and applications belonging to other users due to improper functional level access control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-17475

Affected Vendors & Products

Vendor	Product	Version / Range
IBM	Planning	Analytics 2.0
IBM	Planning	Analytics 2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in IBM Planning Analytics 2.0 and 2.1 allows a remote authenticated attacker to delete folders and applications belonging to other users due to improper access control.

Impact Analysis

An attacker could delete important data or applications you rely on, disrupting your work or causing data loss. This requires the attacker to already have authenticated access to the system.

Compliance Impact

This vulnerability could lead to unauthorized data deletion, potentially violating integrity requirements in GDPR or HIPAA. It may also indicate insufficient access controls, which could be a compliance issue.

Mitigation Strategies

Apply the latest IBM Planning Analytics updates or patches to address the improper functional level access control issue. Review and restrict user permissions to prevent unauthorized folder and application deletions.

Hi! I’m here to help you understand CVE-2026-17475. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70