---
id: "CVE-2019-4716"
kind: "vulnerability"
aliases: ["CVE-2019-4716"]
title: "IBM Planning Analytics: IBM Planning Analytics Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.86441
exploited: true
status: "open"
category: "vendor"
products: [{"name": "IBM Planning Analytics", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ibm-planning-analytics", "linux", "tm1", "vendor", "windows"]
not_affected_if: ["unknown"]
published_at: "2019-12-18T17:16:43+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-4716", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-4716", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4716", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# IBM Planning Analytics: IBM Planning Analytics Remote Code Execution Vulnerability

IBM Planning Analytics has a flaw that lets an unauthenticated user overwrite its configuration and log in as the admin account. From there an attacker can run code as root or SYSTEM through TM1 scripting, and CISA lists it as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM Planning Analytics affected ? fixed ?

## Fix

Apply the IBM updates for Planning Analytics per vendor instructions; the specific fixed version is not stated in the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-4716
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-4716
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-4716

## From the sources

IBM Planning Analytics is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_