---
id: "CVE-2026-96146"
page: "https://infrastack.ai/live/CVE-2026-96146"
kind: "vulnerability"
aliases: ["CVE-2026-96146"]
title: "IBM SevOne Network Performance Management: remote denial of service via resource exhaustion"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "IBM SevOne Network Performance Management", "fixed": ["NMS 8.2.3", "SD-WAN 8.2.3", "DI 8.2.4"], "affected": ">= 7.0.0, <= 8.2.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ibm", "infrastructure", "network-monitoring", "sevone"]
not_affected_if: ["version-outside-range"]
published_at: "2026-11-08T20:17:25+00:00"
first_seen_at: "2026-11-08T20:22:47+00:00"
updated_at: "2026-11-08T20:24:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96146", "first_seen_at": "2026-11-08T20:22:47+00:00"}, {"source": "analyst", "url": "https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-previously-addressed-ibm-sevone-network-performance-management", "first_seen_at": "2026-11-08T20:24:25+00:00", "cites": ["https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-previously-addressed-ibm-sevone-network-performance-management"]}]
exploit_sources: []
---

# IBM SevOne Network Performance Management: remote denial of service via resource exhaustion

Link for people: https://infrastack.ai/live/CVE-2026-96146 (this .md is for agents)

IBM SevOne Network Performance Management versions 7.0.0 through 8.2.2 can be made to consume uncontrolled resources. A remote attacker can use this to cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:IBM SevOne Network Performance Management affected >= 7.0.0, <= 8.2.2 fixed NMS 8.2.3, SD-WAN 8.2.3, DI 8.2.4

## How to check

Check the installed SevOne version for each component (NMS, SD-WAN, DI). Versions 7.0.0 through 8.2.2 are listed as affected; IBM lists NMS 8.2.3, SD-WAN 8.2.3 and DI 8.2.4 as the remediation versions.

## Fix

Upgrade IBM SevOne Network Performance Management to NMS 8.2.3, SD-WAN 8.2.3 or DI 8.2.4 (or later), per IBM bulletin 7289655.

## Timeline

- 2026-11-08T20:22:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96146
- 2026-11-08T20:24:25+00:00 analyst https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-previously-addressed-ibm-sevone-network-performance-management — Read IBM bulletin 7289655 (historical 'previously addressed', published 2026-09-26): CVE-2026-96146 is CWE-400 remote DoS, affected 7.0.0-8.2.2 (page metadata says 7.1.0, table says 7.0.0). Latest fixed versions: DI 8.2.4, NMS 8.2.3, SD-WAN 8.2.3. No exposure conditions, exploitation or PoC stated; no social search done (B tier, low-profile).

## Documents

- [advisory] IBM Security Bulletin: Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management (7289655) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-previously-addressed-ibm-sevone-network-performance-management

## From the sources

IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_