SQL Injection in IBM Operational Decision Manager Leads to RCE

IBM Operational Decision Manager (ODM) versions 9.6.0.0, 9.5.0.0, 9.5.0.1, 9.0.0.1, 8.12.0.1, 8.11.1.0, and 8.11.0.1 are susceptible to a high-severity SQL injection vulnerability, identified as CVE-2026-18658. The flaw exists in the processing of user-supplied data, permitting an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database. By leveraging the database's file system interaction capabilities, an attacker can write malicious scripts to the application's web root directory. This persistence mechanism allows the attacker to execute arbitrary code with the privileges of the web application service account. Given the nature of the application, which often manages critical business logic and rule sets, successful exploitation could lead to significant data exfiltration, business process manipulation, or total system compromise. Defenders must identify exposed instances of IBM ODM and prioritize patching to the latest secure version.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing IBM Operational Decision Manager instances.
2. Attacker probes vulnerable input parameters within the application that interact with the database.
3. Attacker submits crafted SQL injection payloads designed to bypass application-level sanitization.
4. Attacker verifies successful SQL execution through blind or error-based feedback mechanisms.
5. Attacker utilizes database-specific commands, such as INTO OUTFILE, to write a malicious web shell to the application web root.
6. Attacker confirms the location of the uploaded web shell via HTTP GET requests.
7. Attacker interacts with the web shell to execute arbitrary operating system commands, achieving remote code execution.
8. Attacker proceeds with post-exploitation activities, such as lateral movement or data staging.

Impact

The vulnerability carries a CVSS 3.1 base score of 9.8, indicating critical impact. Successful exploitation results in complete loss of confidentiality, integrity, and availability of the affected ODM instance. This allows attackers to manipulate business decision rules, exfiltrate sensitive rule data, and gain persistent access to the server hosting the application, impacting enterprise decision-making processes.

Recommendation

1. Audit network perimeters to identify internet-facing instances of IBM Operational Decision Manager.
2. Apply the latest security patches provided by IBM for versions 9.6.0.0, 9.5.0.0, 9.5.0.1, 9.0.0.1, 8.12.0.1, 8.11.1.0, and 8.11.0.1 to address CVE-2026-18658.
3. Implement strict input validation and parameterized queries at the application level for all database-interfacing components.
4. Restrict database user account permissions to prevent file system operations like writing to web directories.
5. Monitor web server logs for suspicious requests containing SQL keywords (e.g., SELECT, UNION, INTO OUTFILE) targeting ODM endpoints.