{"id":"CVE-2019-4716","kind":"vulnerability","aliases":["CVE-2019-4716"],"related":[],"title":"IBM Planning Analytics: IBM Planning Analytics Remote Code Execution Vulnerability","description":"IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as \"admin\", and then execute code as root or SYSTEM via TM1 scripting.\n\nCISA required action: Apply updates per vendor instructions.","summary":"IBM Planning Analytics has a flaw that lets an unauthenticated user overwrite its configuration and log in as the admin account. From there an attacker can run code as root or SYSTEM through TM1 scripting, and CISA lists it as actively exploited.","severity":"critical","cvss":10.0,"epss":0.86441,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"IBM Planning Analytics","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ibm-planning-analytics","linux","tm1","vendor","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the IBM updates for Planning Analytics per vendor instructions; the specific fixed version is not stated in the sources.","status":"open","published_at":"2019-12-18T17:16:43+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:38+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:37:38Z","model":"claude-haiku-5-5","output":{"fix":"Apply the IBM updates for Planning Analytics per vendor instructions; the specific fixed version is not stated in the sources.","reach":"network","impact":"high","summary":"IBM Planning Analytics has a flaw that lets an unauthenticated user overwrite its configuration and log in as the admin account. From there an attacker can run code as root or SYSTEM through TM1 scripting, and CISA lists it as actively exploited.","category":"vendor","who_cares":["ibm-planning-analytics","tm1","windows","linux"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker gains admin and runs code as root or SYSTEM.","analyst_note":"Find the IBM security bulletin for CVE-2019-4716 to get affected and fixed versions and a configuration check; the KEV entry only says apply vendor updates.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000472,"input_tokens":2850,"output_tokens":373,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the IBM security bulletin for CVE-2019-4716 to get affected and fixed versions and a configuration check; the KEV entry only says apply vendor updates.","search":"'-2019':12A,15A '-4716':13A,16A 'account':49B 'action':102C 'activ':69B 'admin':48B,88C 'allow':81C 'analyt':3A,6A,24B,31B,73C 'analytics':19A 'appli':103C 'attack':53B 'cisa':65B,100C 'code':8A,56B,92C 'configur':42B,78C 'cve':11A,14A 'execut':9A,91C 'exploit':20B,70B 'flaw':34B 'ibm':1A,4A,17A,22B,29B,71C 'ibm-planning-analyt':21B 'instruct':107C 'let':36B 'linux':25B 'list':66B 'log':44B 'login':86C 'overwrit':40B,79C 'per':105C 'plan':2A,5A,23B,30B,72C 'planning':18A 'remot':7A 'requir':101C 'root':58B,94C 'run':55B 'script':63B,99C 'system':60B,96C 'tm1':26B,62B,98C 'unauthent':38B,83C 'updat':104C 'user':39B,84C 'vendor':27B,106C 'via':97C 'vulner':10A,75C 'window':28B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-12-18T17:16:43+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-4716","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-4716","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2019-4716","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-4716","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-4716","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-4716","severity":null,"published_at":"2019-12-18T17:16:43+00:00","modified_at":"2026-06-17T02:36:50+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}