IBM Optim: Path traversal information disclosure (CVE-2026-17466)
IBM Optim versions 1.0.0 through 1.2.0 contain a path traversal vulnerability that permits remote, authenticated attackers to read unauthorized sensitive files on the host system.
CVE search metadata
CVE search record: CVE-2026-17466. Severity: critical. CVSS: 9.1. KEV: no. Product: Optim (1.0.0, 1.1.0, 1.2.0), Optim Test Data Management (1.0.0, 1.1.0, 1.2.0). Brief: IBM Optim: Path traversal information disclosure (CVE-2026-17466). Brief link: https://feed.craftedsignal.io/briefs/2026-11-ibm-optim-path-traversal/
Triage facts
Revision 2- Applicability
- Optim (1.0.0, 1.1.0, 1.2.0), Optim Test Data Management (1.0.0, 1.1.0, 1.2.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 8, 20:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Roughly even chance
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_products, claim_state, has_poc, lastmod, poc_references, references, updates
Sources: 1
IBM Optim versions 1.0.0, 1.1.0, and 1.2.0 contain a path traversal vulnerability. An authenticated attacker can leverage this flaw to access sensitive files on the underlying host system, leading to unauthorized information disclosure. No specific patch information is provided in the initial advisory; users should monitor IBM security updates for remediation guidance.
Impact
The vulnerability is rated with a CVSS v3.1 score of 9.1. Successful exploitation allows an authenticated attacker to read arbitrary files from the filesystem accessible to the application process, potentially exposing credentials, configuration data, or system-level information.
Recommendation
- Identify all instances of IBM Optim 1.0.0, 1.1.0, and 1.2.0 within the environment.
- Monitor IBM official security bulletins for the release of security patches addressing CVE-2026-17466.
- Until a patch is applied, restrict access to the IBM Optim management interface to authorized, known administrative subnets only.
- Review application access logs for repeated file access requests containing directory traversal sequences (e.g., "../", "..\").
Immediate actions
Identify instances of IBM Optim 1.0.0, 1.1.0, and 1.2.0
Threat Hunt
Identify file access requests containing directory traversal patterns in application logs
Data: Application access logs
Mitigations
Restrict network access to IBM Optim management interfaces
CVE-2026-17466