---
id: "CVE-2026-76587"
kind: "vulnerability"
aliases: ["CVE-2026-76587"]
title: "IBM Planning Analytics: stack buffer overflow lets attacker run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "IBM Planning Analytics Local", "fixed": ["2.1.24"], "affected": ">= 2.1.0, <= 2.1.23 (CVE record also lists 2.0)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "ibm-planning-analytics", "other", "self-hosted"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-20T22:19:50+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-24T00:04:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76587", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:04:02+00:00"}]
---

# IBM Planning Analytics: stack buffer overflow lets attacker run code

Stack-based buffer overflow (CWE-121) in IBM Planning Analytics 2.0 and 2.1, CVSS 8.8 (AV:N/AC:L/PR:L/UI:N). A low-privileged authenticated network attacker can run arbitrary code on the server. IBM fixed it in Planning Analytics Local 2.1.24 (Workspace component bulletin). Planning Analytics Cloud was already remediated by IBM. No known exploitation or public PoC found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM Planning Analytics Local affected >= 2.1.0, <= 2.1.23 (CVE record also lists 2.0) fixed 2.1.24

## How to check

Self-hosted Planning Analytics Local only: check the installed version in Planning Analytics Workspace (Help > About) or your install manifest. 2.1.23 or lower is vulnerable. Cloud customers need do nothing.

## Fix

Upgrade Planning Analytics Local to 2.1.24 (download from IBM Fix Central). Until then, limit network access to the Planning Analytics servers and review which accounts hold logins.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76587
- 2026-10-24T00:04:02+00:00 analyst — IBM bulletin https://www.ibm.com/support/pages/node/7291604 (published 2026-10-07) lists the CVE with CVSS 8.8 PR:L and fix in 2.1.24. The fix table (2.1.0-2.1.23 -> 2.1.24, Cloud remediated) came from the OpenCVE copy of IBM's remediation text. The bulletin text I got was truncated before its fix table. The bulletin's own CVE entry doesn't name versions. The same bulletin lists a separate, similar CVE-2026-85457; don't merge. No exploitation or PoC seen; I skipped the social search as there was no sign of a conversation.

## Documents

- [advisory] IBM Security Bulletin: Planning Analytics Local is affected by security vulnerabilities (Workspace 2.1.24) https://www.ibm.com/support/pages/node/7291604
- [fix] OpenCVE: CVE-2026-76587 (carries IBM remediation table) https://app.opencve.io/cve/CVE-2026-76587

## From the sources

IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_