IBM SEVONE NETWORK PERFORMANCE MANAGEMENT · CVE-2026-96146 · Infrastructure
FIX → DI 8.2.4 +2 ✓ verified
IBM SevOne Network Performance Management versions 7.0.0 through 8.2.2 can be made to consume uncontrolled resources. A remote attacker can use this to cause a denial of service.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running IBM SevOne Network Performance Management 7.0.0 through 8.2.2 (NMS, SD-WAN or DI components). IBM says a remote attacker can cause a denial of service through uncontrolled resource consumption (CWE-400); the bulletin does not state which settings or network exposure are needed. NMS 8.2.3, SD-WAN 8.2.3 and DI 8.2.4 or later are the remediation versions, so teams already there can skip it.
Not affected if version-outside-range
Who cares ibm, network-monitoring, sevone
7.0.0 through 8.2.2 are listed as affected; IBM lists NMS 8.2.3, SD-WAN 8.2.3 and DI 8.2.4 as the remediation versionsIBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to DI 8.2.4 +2
Upgrade IBM SevOne Network Performance Management to NMS 8.2.3, SD-WAN 8.2.3 or DI 8.2.4 (or later), per IBM bulletin 7289655.