IBM has disclosed CVE-2026-114464, a critical improper access control vulnerability (CVSS 9.3) in IBM Process Mining versions 2.0.0 through 2.2.1 that could let an attacker obtain sensitive information.
What Is It
CVE-2026-114464 is an improper access control weakness (CWE-284) in IBM Process Mining. According to the NVD record, which IBM PSIRT submitted, a remote attacker could exploit the flaw to obtain sensitive information.
The record was published on November 8, 2026. Its NVD status is "Awaiting Analysis," so NVD has not yet independently assessed it.
Why It Matters
IBM rates this flaw 9.3 (CRITICAL) under CVSS v3.1, with the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. In plain terms:
- No credentials or user interaction required: the attacker does not need privileges, and no victim has to click anything.
- Low attack complexity: exploitation does not depend on special conditions.
- Changed scope: the impact can reach beyond the vulnerable component itself.
- High confidentiality and integrity impact: the score assumes serious exposure of data and possible tampering. Availability is not affected.
The vector lists the attack vector as Adjacent Network, which means the attacker needs access to the same network segment. That sits somewhat at odds with the description's "remote attacker" wording. Defenders should take network position into account when they assess exposure.
Exploitation status: CVE-2026-114464 is not currently in CISA's Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm any active exploitation.
What's Vulnerable
- Vendor: IBM
- Product: Process Mining
- Affected versions: 2.0.0 through 2.2.1 (inclusive)
Any deployment running a release in this range should be treated as affected.
Patch Status
The NVD record does not name a fixed version or give specific remediation steps. IBM has published a security bulletin, linked below. Administrators should check it for guidance on fixed releases or mitigations and act on it promptly, given the critical score.
There is no CISA KEV entry, so no federal remediation deadline or KEV required action applies at this time.