IBM TRIRIGA APPLICATION PLATFORM · CVE-2026-110273 · Vendor
NO FIX YET
IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.9 fail to neutralize special characters in input passed to an OS command. A remote attacker with a valid login can execute arbitrary code on the server.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running IBM TRIRIGA Application Platform in the 5.0.0 to 5.0.9 range are affected, as the sources list that range. The attacker needs a valid authenticated account on the platform. Sources do not describe which features or configurations are required.
Not affected if auth-required, outside-affected-range
Who cares auth-required, enterprise-apps, ibm-tririga
5.0.0 through 5.0.9 is the stated affected range)5.0.9 is fixed: it is inside the rangeNo fix yet, per the sources.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.9 IBM TRIRIGA could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.