IBM PROCESS MINING · CVE-2026-114464 · Vendor
FIX → 2.2.1 IF001 ✓ verified
IBM Process Mining versions 2.0.0 through 2.2.1 have an improper access control flaw. A remote attacker can obtain sensitive information from the product.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running IBM Process Mining 2.0.0 through 2.2.1, on OpenShift (OCP) or on-prem. IBM rates it 9.3 with an adjacent-network vector and no authentication or user interaction, so exposure is mainly to anyone who can reach the service from the same network segment. IBM does not name a required setting. Teams not running Process Mining can skip it.
Who cares enterprise, ibm-process-mining, openshift, self-hosted
2.0.0 through 2.2.1 are affected, including 2.2.1 without IF0012.2.1 IF001IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.
This page as .md · .json · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2.2.1 IF001
2.2.1 IF0012.2.1 IF001; IBMs text also says installing 2.2.1', so confirm the exact build with IBM