IBM Optim versions 1.0.0, 1.1.0, and 1.2.0 have a path traversal flaw, rated CVSS 9.1 (Critical), that could allow a remote authenticated attacker to obtain sensitive information.
What Is It
CVE-2026-17466 is a path traversal vulnerability (CWE-22) in IBM Optim. IBM PSIRT, the CNA for this record, says the flaw "could allow a remote authenticated attacker to obtain sensitive information due to path traversal."
The CVE was published to NVD on November 8, 2026, and its status is currently Awaiting Analysis. That means NVD has not yet added its own enrichment, so the scoring below comes from IBM.
Why It Matters
IBM gives the flaw a CVSS v3.1 base score of 9.1 (CRITICAL) with this vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
In practice:
- Attack vector: Network. It can be exploited remotely.
- Attack complexity: Low. No special conditions are needed.
- Privileges required: Low. The attacker needs an account, but only a low-privilege one.
- User interaction: None.
- Scope: Changed. The impact can reach beyond the vulnerable component.
- Impact: High to confidentiality, Low to integrity, Low to availability.
The low bar for exploitation, combined with high confidentiality impact and a changed scope, is what puts this in the critical range despite the authentication requirement. Any deployment where many users hold accounts, or where credentials could be compromised, faces more risk.
The supplied data contains no CISA KEV entry for this CVE. KEV does not currently confirm active exploitation.
What's Vulnerable
According to IBM's affected-product data:
| Vendor | Product | Affected Versions |
|---|---|---|
| IBM | Optim | 1.0.0 |
| IBM | Optim | 1.1.0 |
| IBM | Optim | 1.2.0 |
Matching CPEs:
- cpe:2.3:a:ibm:optim:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:optim:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:optim:1.2.0:*:*:*:*:*:*:*
Patch Status
The supplied NVD record does not name a fixed version or specific remediation steps. IBM has published a support page for this issue, linked below. Organizations running affected Optim versions should check that advisory for fix availability and mitigation guidance.
There is no KEV entry, so no CISA-required action or remediation due date applies at this time.