IBM has disclosed a critical (CVSS 9.8) SQL injection flaw in Operational Decision Manager that lets an unauthenticated attacker execute arbitrary SQL and pivot to remote code execution by writing a web shell into the application web root.
What Is It
CVE-2026-18658 is a SQL injection vulnerability (CWE-89) in IBM Operational Decision Manager, reported by IBM PSIRT and published on 2026-09-04. Per the vendor description, an unauthenticated attacker can execute arbitrary SQL statements against the backing database and then leverage database functionality to write a web shell to the application web root, resulting in remote code execution.
IBM assigns a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The exploitability subscore is 3.9, the maximum, reflecting a network-reachable attack path with low complexity, no privileges, and no user interaction.
Why It Matters
This is the worst-case shape for an enterprise middleware bug: no credentials, no user interaction, and a documented path from injection to code execution rather than data theft alone. Confidentiality, integrity, and availability impacts are all rated HIGH. Operational Decision Manager typically sits inside business-critical decisioning infrastructure with privileged database connectivity, so a web shell dropped in the web root gives an attacker a persistent foothold on the application host.
The NVD record is still in Received status, meaning NVD enrichment and analysis are not yet complete. Defenders should treat the vulnerability on its technical merits; the CVSS profile alone justifies emergency patching timelines regardless of whether exploitation has been observed in the wild.
What's Vulnerable
IBM Operational Decision Manager, at these versions listed as affected:
- 9.6.0.0
- 9.5.0.1
- 9.5.0.0
- 9.0.0.1
- 8.12.0.1
- 8.11.1.0
- 8.11.0.1
No other products or versions are identified in the source data.
Patch Status
IBM has published a support advisory for this issue at https://www.ibm.com/support/pages/node/7286196, which is the sole reference in the NVD record. The supplied data does not specify fixed version numbers, interim fixes, or workarounds; administrators should consult the IBM advisory directly for remediation guidance.
Sources
- NVD, CVE-2026-18658: https://nvd.nist.gov/vuln/detail/CVE-2026-18658
- IBM Support advisory (IBM PSIRT): https://www.ibm.com/support/pages/node/7286196