CVE-2026-18525 · Infrastructure
NO FIX YET
IBM Secure Proxy versions 6.1.0.0 through 6.2.1.2 do not properly validate listener IP address and port settings. A remote attacker with a valid login can use this to cause a denial of service.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running IBM Secure Proxy in the affected version range. The flaw requires an authenticated remote user, so exposure depends on who holds valid accounts on the proxy. The sources do not describe specific configurations beyond the version range.
Not affected if version-outside-range
Who cares ibm, secure-proxy, self-hosted
No fix yet, per the sources.
IBM Secure Proxy 6.1.0.0 through 6.2.1.2 could allow a remote authenticated attacker to cause a denial of service due to improper validation of listener IP address and port.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.