IBM UCD up to 7.2.3.23/7.3.2.18 log file

Summaryinfo

A vulnerability categorized as problematic has been discovered in IBM UCD up to 7.2.3.23/7.3.2.18. The impacted element is an unknown function. Such manipulation leads to log file. This vulnerability is traded as CVE-2026-12086. An attack has to be approached locally. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM UCD up to 7.2.3.23/7.3.2.18 and classified as problematic. Affected by this issue is an unknown functionality. The manipulation with an unknown input leads to a log file vulnerability. Using CWE to declare the problem leads to CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. Impacted is confidentiality. CVE summarizes:

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 stores potentially sensitive information in log files that could be read by a local user.

The advisory is shared for download at ibm.com. This vulnerability is handled as CVE-2026-12086 since 06/12/2026. The exploitation is known to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• IBM

Name

• UCD

Version

• 7.2.3.0
• 7.2.3.1
• 7.2.3.2
• 7.2.3.3
• 7.2.3.4
• 7.2.3.5
• 7.2.3.6
• 7.2.3.7
• 7.2.3.8
• 7.2.3.9
• 7.2.3.10
• 7.2.3.11
• 7.2.3.12
• 7.2.3.13
• 7.2.3.14
• 7.2.3.15
• 7.2.3.16
• 7.2.3.17
• 7.2.3.18
• 7.2.3.19
• 7.2.3.20
• 7.2.3.21
• 7.2.3.22
• 7.2.3.23
• 7.3.2.0
• 7.3.2.1
• 7.3.2.2
• 7.3.2.3
• 7.3.2.4
• 7.3.2.5
• 7.3.2.6
• 7.3.2.7
• 7.3.2.8
• 7.3.2.9
• 7.3.2.10
• 7.3.2.11
• 7.3.2.12
• 7.3.2.13
• 7.3.2.14
• 7.3.2.15
• 7.3.2.16
• 7.3.2.17
• 7.3.2.18

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion