{"id":"CVE-2026-76587","kind":"vulnerability","aliases":["CVE-2026-76587"],"related":[],"title":"IBM Planning Analytics: stack buffer overflow lets attacker run code","description":"IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.","summary":"Stack-based buffer overflow (CWE-121) in IBM Planning Analytics 2.0 and 2.1, CVSS 8.8 (AV:N/AC:L/PR:L/UI:N). A low-privileged authenticated network attacker can run arbitrary code on the server. IBM fixed it in Planning Analytics Local 2.1.24 (Workspace component bulletin). Planning Analytics Cloud was already remediated by IBM. No known exploitation or public PoC found.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM Planning Analytics Local","fixed":["2.1.24"],"affected":">= 2.1.0, <= 2.1.23 (CVE record also lists 2.0)","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","ibm-planning-analytics","other","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Self-hosted Planning Analytics Local only: check the installed version in Planning Analytics Workspace (Help > About) or your install manifest. 2.1.23 or lower is vulnerable. Cloud customers need do nothing.","fix":"Upgrade Planning Analytics Local to 2.1.24 (download from IBM Fix Central). Until then, limit network access to the Planning Analytics servers and review which accounts hold logins.","status":"open","published_at":"2026-10-20T22:19:50+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:46+00:00","updated_at":"2026-10-24T00:04:02+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-23T22:34:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM Planning Analytics: stack buffer overflow lets attacker run code","impact":"high","summary":"IBM Planning Analytics versions 2.0 and 2.1 contain a stack-based buffer overflow caused by missing bounds checks. An attacker who triggers it can overwrite the stack and execute arbitrary code on the server.","category":"other","who_cares":["ibm-planning-analytics"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the Planning Analytics server.","analyst_note":"Find IBM's security bulletin for CVE-2026-76587 to get the fixed version, the vulnerable component, and whether authentication is required; source is https://nvd.nist.gov/vuln/detail/CVE-2026-76587.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000474,"input_tokens":2910,"output_tokens":365,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find IBM's security bulletin for CVE-2026-76587 to get the fixed version, the vulnerable component, and whether authentication is required; source is https://nvd.nist.gov/vuln/detail/CVE-2026-76587.","search":"'-121':38B '-2026':12A,15A '-76587':13A,16A '2.0':43B,96C '2.1':45B,98C '2.1.24':74B '8.8':47B 'alreadi':82B 'analyt':3A,27B,42B,72B,79B,95C 'analytics':19A 'arbitrari':62B,121C 'attack':8A,59B,114C 'auth':22B 'auth-requir':21B 'authent':57B 'av':48B 'base':34B,105C 'bound':111C 'buffer':5A,35B,106C,118C 'bulletin':77B 'caus':108C 'check':112C 'cloud':80B 'code':10A,63B,122C 'compon':76B 'could':115C 'cve':11A,14A 'cvss':46B 'cwe':37B 'execut':120C 'exploit':88B 'fix':68B 'found':92B 'host':31B 'ibm':1A,17A,25B,40B,67B,85B,93C 'ibm-planning-analyt':24B 'improp':110C 'known':87B 'l/pr':50B 'l/ui':51B 'let':7A 'local':20A,73B 'low':55B 'low-privileg':54B 'n':52B 'n/ac':49B 'network':58B 'overflow':6A,36B,107C,116C 'plan':2A,26B,41B,71B,78B,94C 'planning':18A 'poc':91B 'privileg':56B 'public':90B 'remedi':83B 'requir':23B 'run':9A,61B 'self':30B 'self-host':29B 'server':66B 'stack':4A,33B,104C 'stack-bas':32B,103C 'system':125C 'vulner':100C 'workspac':75B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76587","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76587","severity":null,"published_at":"2026-10-20T22:19:50+00:00","modified_at":"2026-10-23T12:18:16+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-76587:577","url":null,"severity":null,"published_at":"2026-10-24T00:04:02+00:00","modified_at":"2026-10-24T00:04:02+00:00","first_seen_at":"2026-10-24T00:04:02+00:00","fetched_at":"2026-10-24T00:04:02+00:00","note":"IBM bulletin https://www.ibm.com/support/pages/node/7291604 (published 2026-10-07) lists the CVE with CVSS 8.8 PR:L and fix in 2.1.24. The fix table (2.1.0-2.1.23 -> 2.1.24, Cloud remediated) came from the OpenCVE copy of IBM's remediation text. The bulletin text I got was truncated before its fix table. The bulletin's own CVE entry doesn't name versions. The same bulletin lists a separate, similar CVE-2026-85457; don't merge. No exploitation or PoC seen; I skipped the social search as there was no sign of a conversation."}],"documents":[{"id":2328,"url":"https://www.ibm.com/support/pages/node/7291604","title":"IBM Security Bulletin: Planning Analytics Local is affected by security vulnerabilities (Workspace 2.1.24)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2329,"url":"https://app.opencve.io/cve/CVE-2026-76587","title":"OpenCVE: CVE-2026-76587 (carries IBM remediation table)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}