{"id":"CVE-2026-18525","kind":"vulnerability","aliases":["CVE-2026-18525"],"related":[],"title":"IBM Secure Proxy: authenticated remote user can cause denial of service","description":"IBM Secure Proxy 6.1.0.0 through 6.2.1.2 could allow a remote authenticated attacker to cause a denial of service due to improper validation of listener IP address and port.","summary":"IBM Secure Proxy versions 6.1.0.0 through 6.2.1.2 do not properly validate listener IP address and port settings. A remote attacker with a valid login can use this to cause a denial of service.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm","infrastructure","secure-proxy","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed IBM Secure Proxy version against the affected range 6.1.0.0 through 6.2.1.2","fix":null,"status":"open","published_at":"2026-11-08T18:17:04+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","triaged_at":"2026-11-08T18:23:01+00:00","updated_at":"2026-11-08T18:23:01+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T18:23:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Secure Proxy: authenticated remote user can cause denial of service","impact":"low","summary":"IBM Secure Proxy versions 6.1.0.0 through 6.2.1.2 do not properly validate listener IP address and port settings. A remote attacker with a valid login can use this to cause a denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm","secure-proxy","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Remote authenticated user crashes or disrupts the proxy service","analyst_note":"Check the IBM security bulletin for this CVE to confirm the fixed version and any configuration details.","how_to_check":"- Check the installed IBM Secure Proxy version against the affected range 6.1.0.0 through 6.2.1.2\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Organizations running IBM Secure Proxy in the affected version range. The flaw requires an authenticated remote user, so exposure depends on who holds valid accounts on the proxy. The sources do not describe specific configurations beyond the version range.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4532,"output_tokens":495,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-18525':14A,17A '-2026':13A,16A '6.1.0.0':30B,62C '6.2.1.2':32B,64C 'address':39B,84C 'allow':66C 'attack':45B,70C 'authent':4A,69C 'caus':8A,54B,72C 'could':65C 'cve':12A,15A 'denial':9A,56B,74C 'due':77C 'host':25B 'ibm':1A,18B,26B,59C 'improp':79C 'infrastructur':19B 'ip':38B,83C 'listen':37B,82C 'login':49B 'port':41B,86C 'proper':35B 'proxi':3A,22B,28B,61C 'remot':5A,44B,68C 'secur':2A,21B,27B,60C 'secure-proxi':20B 'self':24B 'self-host':23B 'servic':11A,58B,76C 'set':42B 'use':51B 'user':6A 'valid':36B,48B,80C 'version':29B","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Secure Proxy in the affected version range. The flaw requires an authenticated remote user, so exposure depends on who holds valid accounts on the proxy. The sources do not describe specific configurations beyond the version range.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibm","infrastructure","medium","secureproxy","selfhosted"],"campaign_type":null,"search_a":"'-18525':14A,17A '-2026':13A,16A 'authent':4A 'caus':8A 'cve':12A,15A 'denial':9A 'ibm':1A 'proxi':3A 'remot':5A 'secur':2A 'servic':11A 'user':6A","search_b":"'6.1.0.0':30B '6.2.1.2':32B 'address':39B 'attack':45B 'caus':54B 'denial':56B 'host':25B 'ibm':18B,26B 'infrastructur':19B 'ip':38B 'listen':37B 'login':49B 'port':41B 'proper':35B 'proxi':22B,28B 'remot':44B 'secur':21B,27B 'secure-proxi':20B 'self':24B 'self-host':23B 'servic':58B 'set':42B 'use':51B 'valid':36B,48B 'version':29B","search_c":"'6.1.0.0':62C '6.2.1.2':64C 'address':84C 'allow':66C 'attack':70C 'authent':69C 'caus':72C 'could':65C 'denial':74C 'due':77C 'ibm':59C 'improp':79C 'ip':83C 'listen':82C 'port':86C 'proxi':61C 'remot':68C 'secur':60C 'servic':76C 'valid':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18525","severity":null,"published_at":"2026-11-08T18:17:04+00:00","modified_at":"2026-11-08T18:17:04+00:00","first_seen_at":"2026-11-08T18:22:22+00:00","fetched_at":"2026-11-08T18:22:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}