IBM UCD up to 7.3.2.18 Configuration insertion of sensitive information into sent data

Summaryinfo

A vulnerability was found in IBM UCD up to 7.3.2.18 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Configuration Handler. Such manipulation leads to insertion of sensitive information into sent data. This vulnerability is documented as CVE-2026-12085. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM UCD up to 7.3.2.18 and classified as problematic. Affected by this issue is an unknown code of the component Configuration Handler. The manipulation with an unknown input leads to a insertion of sensitive information into sent data vulnerability. Using CWE to declare the problem leads to CWE-201. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. Impacted is confidentiality. CVE summarizes:

IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.

The advisory is available at ibm.com. This vulnerability is handled as CVE-2026-12085 since 06/12/2026. The exploitation is known to be easy. The attack may be launched remotely. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/01/2026). This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

Upgrading eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• IBM

Name

• UCD

Version

• 7.3.2.0
• 7.3.2.1
• 7.3.2.2
• 7.3.2.3
• 7.3.2.4
• 7.3.2.5
• 7.3.2.6
• 7.3.2.7
• 7.3.2.8
• 7.3.2.9
• 7.3.2.10
• 7.3.2.11
• 7.3.2.12
• 7.3.2.13
• 7.3.2.14
• 7.3.2.15
• 7.3.2.16
• 7.3.2.17
• 7.3.2.18

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion