{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/qiskit-sdk-1.4.2-2.6.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ibm:qiskit:1.4.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:qiskit:2.6.2:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.4,"id":"CVE-2026-116499"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Qiskit SDK (1.4.2-2.6.2)"],"_cs_severities":["high"],"_cs_tags":["deserialization","rce","python","developer-tools"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eIBM Qiskit SDK versions 1.4.2 through 2.6.2 are affected by a deserialization of untrusted data vulnerability (CVE-2026-116499). A local attacker who can influence the data processed by the SDK may achieve arbitrary code execution. As of the initial disclosure, no specific exploit path or proof-of-concept code has been detailed by the vendor.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker with local access to a system running an affected version of Qiskit may be able to execute arbitrary commands, potentially leading to unauthorized data access or privilege escalation depending on the privileges of the application using the SDK.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all systems and environments utilizing IBM Qiskit SDK versions 1.4.2 through 2.6.2.\u003c/li\u003e\n\u003cli\u003eUpgrade to a non-vulnerable version of Qiskit SDK as soon as an update is released by IBM.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation for any data processed or deserialized by Qiskit components to mitigate the risk until patches are applied.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T21:26:38Z","date_published":"2026-11-08T21:26:38Z","id":"https://feed.craftedsignal.io/briefs/2026-11-qiskit-rce-2a04f3dc/","summary":"IBM Qiskit SDK versions 1.4.2 through 2.6.2 contain a deserialization vulnerability that allows a local attacker to execute arbitrary code within the host environment.","title":"IBM Qiskit SDK: Arbitrary code execution via deserialization (CVE-2026-116499)","url":"https://feed.craftedsignal.io/briefs/2026-11-qiskit-rce-2a04f3dc/"}],"language":"en","title":"CraftedSignal Threat Feed - Qiskit SDK (1.4.2-2.6.2)","version":"https://jsonfeed.org/version/1.1"}