{"id":"CVE-2026-9821","kind":"vulnerability","aliases":["CVE-2026-9821"],"related":[],"title":"IBM Cyber Fraud: unauthorized users can inject data into log files","description":"IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.","summary":"IBM Cyber Fraud versions 1.0.0 through 1.1.0 do not neutralize special characters before writing to log files. An unauthorized user can therefore inject fake or misleading entries into the logs.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-cyber-fraud","logging","other"],"not_affected_if":[],"how_to_check":"- Check whether the installed IBM Cyber Fraud version is between `1.0.0` and `1.1.0`","fix":null,"status":"open","published_at":"2026-11-13T22:17:27+00:00","first_seen_at":"2026-11-13T22:33:35+00:00","triaged_at":"2026-11-13T22:34:40+00:00","updated_at":"2026-11-13T22:34:40+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T22:34:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM Cyber Fraud: unauthorized users can inject data into log files","impact":"low","summary":"IBM Cyber Fraud versions 1.0.0 through 1.1.0 do not neutralize special characters before writing to log files. An unauthorized user can therefore inject fake or misleading entries into the logs.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ibm-cyber-fraud","logging"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"forged or misleading entries appear in application log files","analyst_note":"Find the IBM security bulletin for CVE-2026-9821 to confirm the fixed version, required access, and any workaround.","how_to_check":"- Check whether the installed IBM Cyber Fraud version is between `1.0.0` and `1.1.0`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running IBM Cyber Fraud 1.0.0 through 1.1.0 are affected, since an unauthorized user can write data into their log files. The sources do not describe the required access path or configuration. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4525,"output_tokens":468,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-9821':14A,17A '1.0.0':27B,56C '1.1.0':29B,58C 'allow':60C 'charact':34B 'could':59C 'cve':12A,15A 'cyber':2A,20B,24B,54C 'data':8A,66C 'due':70C 'element':76C 'entri':49B 'fake':46B 'file':11A,39B,81C 'fraud':3A,21B,25B,55C 'ibm':1A,19B,23B,53C 'ibm-cyber-fraud':18B 'improp':72C 'inject':7A,45B,65C 'log':10A,22B,38B,52B,68C,80C 'messag':69C 'mislead':48B 'neutral':32B,73C 'special':33B,75C 'therefor':44B 'unauthor':4A,41B,62C 'user':5A,42B,63C 'version':26B 'write':36B 'written':78C","nicknames":[],"mitigations":[],"who_affected":"Organizations running IBM Cyber Fraud 1.0.0 through 1.1.0 are affected, since an unauthorized user can write data into their log files. The sources do not describe the required access path or configuration. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmcyberfraud","logging","medium","other"],"campaign_type":null,"search_a":"'-2026':13A,16A '-9821':14A,17A 'cve':12A,15A 'cyber':2A 'data':8A 'file':11A 'fraud':3A 'ibm':1A 'inject':7A 'log':10A 'unauthor':4A 'user':5A","search_b":"'1.0.0':27B '1.1.0':29B 'charact':34B 'cyber':20B,24B 'entri':49B 'fake':46B 'file':39B 'fraud':21B,25B 'ibm':19B,23B 'ibm-cyber-fraud':18B 'inject':45B 'log':22B,38B,52B 'mislead':48B 'neutral':32B 'special':33B 'therefor':44B 'unauthor':41B 'user':42B 'version':26B 'write':36B","search_c":"'1.0.0':56C '1.1.0':58C 'allow':60C 'could':59C 'cyber':54C 'data':66C 'due':70C 'element':76C 'file':81C 'fraud':55C 'ibm':53C 'improp':72C 'inject':65C 'log':68C,80C 'messag':69C 'neutral':73C 'special':75C 'unauthor':62C 'user':63C 'written':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-9821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9821","severity":null,"published_at":"2026-11-13T22:17:27+00:00","modified_at":"2026-11-13T22:17:27+00:00","first_seen_at":"2026-11-13T22:33:35+00:00","fetched_at":"2026-11-13T22:33:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}