{"id":"CVE-2026-96146","kind":"vulnerability","aliases":["CVE-2026-96146"],"related":[],"title":"IBM SevOne Network Performance Management: remote denial of service via resource exhaustion","description":"IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.","summary":"IBM SevOne Network Performance Management versions 7.0.0 through 8.2.2 can be made to consume uncontrolled resources. A remote attacker can use this to cause a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"IBM SevOne Network Performance Management","fixed":["NMS 8.2.3","SD-WAN 8.2.3","DI 8.2.4"],"affected":">= 7.0.0, <= 8.2.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["ibm","infrastructure","network-monitoring","sevone"],"not_affected_if":["version-outside-range"],"how_to_check":"Check the installed SevOne version for each component (NMS, SD-WAN, DI). Versions 7.0.0 through 8.2.2 are listed as affected; IBM lists NMS 8.2.3, SD-WAN 8.2.3 and DI 8.2.4 as the remediation versions.","fix":"Upgrade IBM SevOne Network Performance Management to NMS 8.2.3, SD-WAN 8.2.3 or DI 8.2.4 (or later), per IBM bulletin 7289655.","status":"open","published_at":"2026-11-08T20:17:25+00:00","first_seen_at":"2026-11-08T20:22:47+00:00","triaged_at":"2026-11-08T20:23:31+00:00","updated_at":"2026-11-08T20:24:25+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-08T20:23:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM SevOne Network Performance Management: remote denial of service via resource exhaustion","impact":"low","summary":"IBM SevOne Network Performance Management versions 7.0.0 through 8.2.2 can be made to consume uncontrolled resources. A remote attacker can use this to cause a denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm","sevone","network-monitoring"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker makes the monitoring service unavailable","analyst_note":"Confirm the fixed version and any exposure conditions from the IBM security bulletin for CVE-2026-96146.","how_to_check":"- Check the installed SevOne Network Performance Management version against the affected range 7.0.0 through 8.2.2\n- unknown for other checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running IBM SevOne Network Performance Management in the affected range 7.0.0 through 8.2.2 are exposed. The sources do not say which deployment settings or network exposure are required, so unknown whether internet-facing instances are at greater risk. Teams on versions outside that range can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4521,"output_tokens":514,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any exposure conditions from the IBM security bulletin for CVE-2026-96146.","search":"'-2026':14A,17A '-96146':15A,18A '7.0.0':36B,63C '8.2.2':38B,65C 'allow':67C 'attack':48B,70C 'caus':53B,72C 'consum':43B 'consumpt':81C 'could':66C 'cve':13A,16A 'denial':7A,55B,74C 'due':77C 'exhaust':12A 'ibm':1A,19A,24B,30B,58C 'infrastructur':25B 'made':41B 'manag':5A,34B,62C 'management':23A 'monitor':28B 'network':3A,21A,27B,32B,60C 'network-monitor':26B 'perform':4A,33B,61C 'performance':22A 'remot':6A,47B,69C 'resourc':11A,45B,80C 'servic':9A,57B,76C 'sevon':2A,29B,31B,59C 'sevone':20A 'uncontrol':44B,79C 'use':50B 'version':35B 'via':10A","nicknames":[],"mitigations":[],"who_affected":"Anyone running IBM SevOne Network Performance Management 7.0.0 through 8.2.2 (NMS, SD-WAN or DI components). IBM says a remote attacker can cause a denial of service through uncontrolled resource consumption (CWE-400); the bulletin does not state which settings or network exposure are needed. NMS 8.2.3, SD-WAN 8.2.3 and DI 8.2.4 or later are the remediation versions, so teams already there can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-08T20:24:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-previously-addressed-ibm-sevone-network-performance-management","run_id":2221},"products":{"at":"2026-11-08T20:24:25Z","by":"analyst","doc":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-previously-addressed-ibm-sevone-network-performance-management","run_id":2221}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["ibmsevonenetworkperformancemanagement","sevonenetworkperformancemanagement"],"ptokens":["ibm","management","network","performance","sevone"],"labels":["high","ibm","infrastructure","networkmonitoring","sevone"],"campaign_type":null,"search_a":"'-2026':14A,17A '-96146':15A,18A 'cve':13A,16A 'denial':7A 'exhaust':12A 'ibm':1A,19A 'manag':5A 'management':23A 'network':3A,21A 'perform':4A 'performance':22A 'remot':6A 'resourc':11A 'servic':9A 'sevon':2A 'sevone':20A 'via':10A","search_b":"'7.0.0':36B '8.2.2':38B 'attack':48B 'caus':53B 'consum':43B 'denial':55B 'ibm':24B,30B 'infrastructur':25B 'made':41B 'manag':34B 'monitor':28B 'network':27B,32B 'network-monitor':26B 'perform':33B 'remot':47B 'resourc':45B 'servic':57B 'sevon':29B,31B 'uncontrol':44B 'use':50B 'version':35B","search_c":"'7.0.0':63C '8.2.2':65C 'allow':67C 'attack':70C 'caus':72C 'consumpt':81C 'could':66C 'denial':74C 'due':77C 'ibm':58C 'manag':62C 'network':60C 'perform':61C 'remot':69C 'resourc':80C 'servic':76C 'sevon':59C 'uncontrol':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T20:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96146","severity":null,"published_at":"2026-11-08T20:17:25+00:00","modified_at":"2026-11-08T20:17:25+00:00","first_seen_at":"2026-11-08T20:22:47+00:00","fetched_at":"2026-11-08T20:22:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96146:2221","url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-previously-addressed-ibm-sevone-network-performance-management","severity":null,"published_at":"2026-11-08T20:24:25+00:00","modified_at":"2026-11-08T20:24:25+00:00","first_seen_at":"2026-11-08T20:24:25+00:00","fetched_at":"2026-11-08T20:24:25+00:00","note":"Read IBM bulletin 7289655 (historical 'previously addressed', published 2026-09-26): CVE-2026-96146 is CWE-400 remote DoS, affected 7.0.0-8.2.2 (page metadata says 7.1.0, table says 7.0.0). Latest fixed versions: DI 8.2.4, NMS 8.2.3, SD-WAN 8.2.3. No exposure conditions, exploitation or PoC stated; no social search done (B tier, low-profile).","cites":["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-previously-addressed-ibm-sevone-network-performance-management"]}],"documents":[{"id":103524,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-previously-addressed-ibm-sevone-network-performance-management","title":"IBM Security Bulletin: Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management (7289655)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}