High WID-SEC-2026-2242 4 CVEs

IBM Operational Decision Manager: Mehrere Schwachstellen

Published Jul 7, 2026 · Updated Aug 12, 2026 · Revision 3 · de-DE

Vendor: IBM Product: InfoSphere Information Server Product: Operational Decision Manager Product: Tivoli Network Manager Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Operational Decision Manager ausnutzen, um Sicherheitsbeschränkungen zu umgehen, um einen Denial of Service zu verursachen und Code auszuführen.

Product

IBM Operational Decision Manager ist Software für die Integration von Geschäftsereignissen und Geschäftsregeln, um Entscheidungen über verschiedene Prozesse und Anwendungen hinweg zu automatisieren.

Vulnerabilities 4

Critical 9.8

CVE-2026-47065

Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Fully addressed. When the serialised stream contains a TC_PROXYCLASSDESC (the marker for a java.lang.reflect.Proxy ), JDK’s ObjectInputStream.re…

Apache Software Foundation Apache MINA apache-nifi jenkins-2-openjdk-21 Debian Ubuntu Wolfi Maven

Jun 3, 2026
Medium 5.3

CVE-2026-45292

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opente…

open-telemetry io.opentelemetry opentelemetry-java opentelemetry-api Maven

May 28, 2026
Low 2.9

CVE-2026-10532

Logback deserialization whitelist bypass for Proxy objects

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to Si…

QOS.CH Sarl logback thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven

Jun 1, 2026
Low 2.9

CVE-2026-9828

Logback deserialization whitelist bypass for java.lang and java.util

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted. More precisely, an attacker able to influence serialized data sent to Sim…

QOS.CH Sarl logback trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven

May 28, 2026

Revision history

2026-08-12 #3
Neue Updates von IBM aufgenommen
2026-08-11 #2
Neue Updates von IBM aufgenommen
2026-07-07 #1
Initiale Fassung

References

IBM Security Bulletin 7279423 vom 2026-07-07
https://www.ibm.com/support/pages/node/7279423
IBM Security Bulletin 7282933 vom 2026-08-11
https://www.ibm.com/support/pages/node/7282933
IBM Security Bulletin 7283607 vom 2026-08-13
https://www.ibm.com/support/pages/node/7283607