CVE-2026-12085

IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7277577	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:devops_deploy::::::::
	cpe:2.3:a:ibm:devops_deploy::::::::
	cpe:2.3:a:ibm:devops_deploy::::::::
	cpe:2.3:a:ibm:urbancode_deploy::::::::

History

No history.

Information

Published : 2026-06-30 20:17

Updated : 2026-07-02 18:35

NVD link : CVE-2026-12085

Mitre link : CVE-2026-12085

CVE.ORG link : CVE-2026-12085

JSON object : View

Products Affected

ibm

devops_deploy
urbancode_deploy

CWE

CWE-201

Insertion of Sensitive Information Into Sent Data

NVD-CWE-noinfo

{"id": "CVE-2026-12085", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12085", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T14:01:22.988510Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:ucd___ibm_urbancode_deploy:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd___ibm_urbancode_deploy:7.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd___ibm_urbancode_deploy:7.3.2.18:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "UCD - IBM UrbanCode Deploy", "versions": [{"status": "affected", "version": "7.3.0", "versionType": "semver", "lessThanOrEqual": "7.3.2.18"}]}, {"cpes": ["cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.0.1.13:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.1.2.6:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.2.1.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "UCD - IBM DevOps Deploy", "versions": [{"status": "affected", "version": "8.0", "versionType": "semver", "lessThanOrEqual": "8.0.1.13"}, {"status": "affected", "version": "8.1.0", "versionType": "semver", "lessThanOrEqual": "8.1.2.6"}, {"status": "affected", "version": "8.2.0", "versionType": "semver", "lessThanOrEqual": "8.2.1.0"}]}]}], "published": "2026-06-30T20:17:28.547", "references": [{"url": "https://www.ibm.com/support/pages/node/7277577", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-201"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system."}], "lastModified": "2026-07-02T18:35:42.447", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:devops_deploy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26D9E998-DB17-4A71-9452-A26614168759", "versionEndExcluding": "8.0.1.14", "versionStartIncluding": "8.0.0.0"}, {"criteria": "cpe:2.3:a:ibm:devops_deploy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45A6D038-C474-4482-9F59-0152D621ADB9", "versionEndExcluding": "8.1.2.7", "versionStartIncluding": "8.1.0.0"}, {"criteria": "cpe:2.3:a:ibm:devops_deploy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01BE7813-5F11-468B-8DFD-58FF3D46D89A", "versionEndExcluding": "8.2.1.0", "versionStartIncluding": "8.2.0.0"}, {"criteria": "cpe:2.3:a:ibm:urbancode_deploy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "455A02FB-5A16-4E9D-969E-054CF62C44D6", "versionEndExcluding": "7.3.2.19", "versionStartIncluding": "7.3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}