CVE-2026-8636

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7276609	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:datacap:9.1.7:::::::*
	cpe:2.3:a:ibm:datacap:9.1.8:::::::*
	cpe:2.3:a:ibm:datacap:9.1.9:::::::*
	cpe:2.3:a:ibm:datacap_navigator:9.1.7:::::::*
	cpe:2.3:a:ibm:datacap_navigator:9.1.8:::::::*
	cpe:2.3:a:ibm:datacap_navigator:9.1.9:::::::*

History

No history.

Information

Published : 2026-06-22 16:16

Updated : 2026-06-26 21:20

NVD link : CVE-2026-8636

Mitre link : CVE-2026-8636

CVE.ORG link : CVE-2026-8636

JSON object : View

Products Affected

ibm

datacap
datacap_navigator

CWE

CWE-316

Cleartext Storage of Sensitive Information in Memory

{"id": "CVE-2026-8636", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8636", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T16:07:01.577649Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:datacap:9.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:datacap:9.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:datacap:9.1.9:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Datacap", "versions": [{"status": "affected", "version": "9.1.7", "versionType": "semver", "lessThanOrEqual": "1.8.4"}, {"status": "affected", "version": "9.1.8"}, {"status": "affected", "version": "9.1.9"}]}, {"cpes": ["cpe:2.3:a:ibm:datacap_navigator:9.1.7:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:datacap_navigator:9.1.8:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:datacap_navigator:9.1.9:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Datacap Navigator", "versions": [{"status": "affected", "version": "9.1.7", "versionType": "semver", "lessThanOrEqual": "8.2.1.0"}, {"status": "affected", "version": "9.1.8"}, {"status": "affected", "version": "9.1.9"}]}]}], "published": "2026-06-22T16:16:42.233", "references": [{"url": "https://www.ibm.com/support/pages/node/7276609", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-316"}]}], "descriptions": [{"lang": "en", "value": "IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can\u00a0use the same keys to decrypt password, gain access to the application and access sensitive\u00a0data in the database."}], "lastModified": "2026-06-26T21:20:52.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:datacap:9.1.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4854F9C-EB1F-4277-B07F-9599DA1995DF"}, {"criteria": "cpe:2.3:a:ibm:datacap:9.1.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BBD9AE6-DEAB-4D84-9E62-D0B718ED2F2E"}, {"criteria": "cpe:2.3:a:ibm:datacap:9.1.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA9CD5BF-61E6-4A91-A0BF-1031F673701A"}, {"criteria": "cpe:2.3:a:ibm:datacap_navigator:9.1.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26A76CB2-197B-4FA9-A6E8-9BE6624DFC5A"}, {"criteria": "cpe:2.3:a:ibm:datacap_navigator:9.1.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69E3630C-FFC5-4421-A739-3AE9C20E8044"}, {"criteria": "cpe:2.3:a:ibm:datacap_navigator:9.1.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E31E8529-51AA-4BC8-A905-3BCBD9DACDA1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}