{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "activestorage versions ant\u00e9rieures \u00e0 7.2.3.2",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activestorage versions 8.1.x ant\u00e9rieures \u00e0 8.1.3.1",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activestorage versions 8.0.x ant\u00e9rieures \u00e0 8.0.5.1",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-66066",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66066"
    }
  ],
  "initial_release_date": "2026-07-30T00:00:00",
  "last_revision_date": "2026-07-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0948",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-07-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ruby on Rails activestorage. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ruby on Rails activestorage",
  "vendor_advisories": [
    {
      "published_at": "2026-07-29",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 91432",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432"
    }
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "rails",
          "vendor": "rails",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.2.3.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0.beta1, \u003c 8.0.5.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.1.0.beta1, \u003c 8.1.3.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation. Consuming applications are affected when configured to use libvips and accept image uploads from untrusted users. An unauthenticated attacker may exploit this behavior to read arbitrary files accessible to the Rails process, including environment variables and application secrets. Exposure of credentials such as secret_key_base or external-service tokens may enable remote code execution or lateral movement. This issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1."
    }
  ],
  "id": "CVE-2026-66066",
  "lastModified": "2026-09-10T20:36:14.340",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.5,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-66066",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-04T03:56:19.910457Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-30T19:18:35.843",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rails/rails/releases/tag/v7.2.3.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rails/rails/releases/tag/v8.0.5.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rails/rails/releases/tag/v8.1.3.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/07/29/9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/08/01/6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve-2026-66066"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/rails/rails-forensics-CVE-2026-66066"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "activestorage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "activestorage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0.beta1"
            },
            {
              "fixed": "8.0.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "activestorage"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.1.0.beta1"
            },
            {
              "fixed": "8.1.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-66066"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-30T18:23:33Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "### Impact\nIn its default configuration, a Rails application that displays image variants may allow an\nunauthenticated attacker to read arbitrary files from the server, including the process environment.\nThat environment typically holds `secret_key_base` and often credentials for external systems, which\nmay in turn allow escalation to remote code execution or lateral movement to those systems.\n\n### Details\nlibvips reads and writes file formats through \"loaders\" and \"savers\" (or more generally\n\"operations\"), many of which are backed by third-party libraries. It marks some of these operations\nas \"unfuzzed\", meaning they are unsafe for untrusted content, and several handle formats unrelated\nto web images. Active Storage did not disable the unfuzzed operations, so an attacker who can upload\na crafted file and cause a variant to be generated from it may be able to invoke one.\n\nWe are aware of a mechanism by which an attacker, by uploading a crafted file, is able to cause\ndisclosure of the contents of arbitrary files accessible on the filesystem of the targeted\napplication. One specific attack chain has been reported to us (see \"Disclosure\" below), but we do\nnot assume it is the only one that exists.\n\n### Affected applications\nAn application is affected if it meets all of these requirements:\n- Uses libvips for Active Storage image processing. This is `config.active_storage.variant_processor = :vips`,\n  which `load_defaults 7.0` set and no later default has changed.\n- Allows image uploads from untrusted users.\n\nGenerating variants is not a separate requirement.\n\n### Mitigation\n- Upgrade to a fixed version of `activestorage`.\n- The minimum version of libvips must be upgraded to `\u003e= 8.13`.\n- Change `secret_key_base` and change any secrets accessible in the application environment (see \"Expire and change secrets\" below)\n\nEarlier versions of libvips (`\u003c 8.13`) cannot disable unfuzzed operations at all, and Active Storage\nwill raise an exception during boot in such an unsecurable environment.\n\n### Expire and change secrets\n\nUpgrading closes the vulnerability but does not undo an exfiltrated secret if that already\noccurred. An affected application should treat every secret readable by the application process as\npotentially exposed and change it, including:\n\n- `secret_key_base`\n- The master key, whether stored in `config/master.key` or supplied as `RAILS_MASTER_KEY`, along\n  with everything in `config/credentials.yml.enc` that it decrypts\n- Credentials for the Active Storage service, such as S3, GCS, or Azure keys\n- Database credentials\n- Tokens and keys for any third-party service the application calls\n\nChanging `secret_key_base` expires active sessions and requires users to log in again. Encrypted\ncookies, signed cookies, signed global IDs, and Active Storage URLs are also affected.\n\nRotation should only be used as an intermediate step if necessary. Do not retain an exposed secret\nas a fallback.\n\n### Workarounds\nIf libvips `\u003c 8.13` is being used, there are no workarounds available other than removing the\ndependency on libvips from the application. Some applications may have `ruby-vips` declared as a\ndependency only for image analysis, and those applications may be able to simply remove `ruby-vips`\nfrom the Gemfile to remove libvips from the application. Applications that do not use Active Storage\ncan remove `ruby-vips` from the Gemfile to avoid the boot-time checks.\n\nIf libvips `\u003e= 8.13` is present on the system, applications can disable the unfuzzed operations\nwithout upgrading Rails by setting the `VIPS_BLOCK_UNTRUSTED` environment variable, which libvips\nreads while initializing.\n\nApplications also running ruby-vips `\u003e= 2.2.1` or later can instead call\n`Vips.block_untrusted(true)` from an initializer.\n\n### Releases\nThe fixed releases are available at the normal locations.\n\n### Versions affected\n\n- activestorage \u003c 7.2.3.2\n- activestorage \u003e= 8.0, \u003c 8.0.5.1\n- activestorage \u003e= 8.1, \u003c 8.1.3.1\n\n### Disclosure\nTechnical details of the attack chain are intentionally omitted from this advisory. They would add\nnothing to an administrator\u0027s decision to upgrade, while making it substantially easier to attack\napplications that have not yet done so.\n\nDetails will be disclosed no later than 2026-08-28, via the [Rails Security\nAnnouncements](https://discuss.rubyonrails.org/c/security-announcements/9) forum.\n\n### Credit\nThis issue was responsibly reported by [0xacb](https://x.com/0xacb), [s3np41k1r1t0](https://x.com/s3np41k1r1t0) and [castilho](https://x.com/castilho101) from [Ethiack](https://ethiack.com), and [RyotaK](https://ryotak.net) from [GMO Flatt Security Inc.](https://flatt.tech/en/).\n\n### References\n- libvips 8.13 release notes, [blocking of unfuzzed loaders](https://www.libvips.org/2022/05/28/What\u0027s-new-in-8.13.html#blocking-of-unfuzzed-loaders)\n- W.A. Arbaugh, W.L. Fithen, and J. McHugh, [\"Windows of Vulnerability: A Case Study\n  Analysis\"](https://doi.org/10.1109/2.889093), IEEE Computer 33(12), December 2000\n- https://ethiack.com/info-hub/research/kindarails2shell-rails-rce-cve\n- https://blog.flatt.tech/entry/kindarails2shell_rails",
  "id": "GHSA-xr9x-r78c-5hrm",
  "modified": "2026-07-30T18:23:33Z",
  "published": "2026-07-30T18:23:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/commit/1c01bb587206ee6eb0e1179c2cef96a6a47acb1e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/commit/349e7a5d5b4b715af1e416db824f3c078a7d59e5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rails/rails"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/releases/tag/v7.2.3.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/releases/tag/v8.0.5.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/releases/tag/v8.1.3.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2026-66066.yml"
    },
    {
      "type": "WEB",
      "url": "https://thehackernews.com/2026/07/critical-rails-flaw-could-let.html"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-66066"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing"
}

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Ruby on Rails ausnutzen, um Informationen offenzulegen, was m\u00f6glicherweise zur Remote-Codeausf\u00fchrung oder zu lateraler Bewegung f\u00fchren kann.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2574 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2574.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2574 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2574"
      },
      {
        "category": "external",
        "summary": "Rails Vulnerability vom 2026-07-29",
        "url": "https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432"
      },
      {
        "category": "external",
        "summary": "Rails Release Notes vom 2026-07-29",
        "url": "https://rubyonrails.org/2026/7/29/Rails-Versions-7-2-3-2-8-0-5-1-and-8-1-3-1-have-been-released"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-xr9x-r78c-5hrm vom 2026-07-29",
        "url": "https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm"
      },
      {
        "category": "external",
        "summary": "Metasploit CVE-2026-66066",
        "url": "https://github.com/rapid7/metasploit-framework/pull/21733"
      }
    ],
    "source_lang": "en-US",
    "title": "Ruby on Rails: Schwachstelle erm\u00f6glicht Offenlegung von Informationen",
    "tracking": {
      "current_release_date": "2026-08-03T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-04T07:16:11.739+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2574",
      "initial_release_date": "2026-07-29T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-29T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-07-30T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-51270"
        },
        {
          "date": "2026-08-03T22:00:00.000+00:00",
          "number": "3",
          "summary": "Exploit aufgenommen CVE-2026-66066"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c7.2.3.2",
                "product": {
                  "name": "Open Source Ruby on Rails \u003c7.2.3.2",
                  "product_id": "T057379"
                }
              },
              {
                "category": "product_version",
                "name": "7.2.3.2",
                "product": {
                  "name": "Open Source Ruby on Rails 7.2.3.2",
                  "product_id": "T057379-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rubyonrails:ruby_on_rails:7.2.3.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.0.5.1",
                "product": {
                  "name": "Open Source Ruby on Rails \u003c8.0.5.1",
                  "product_id": "T057380"
                }
              },
              {
                "category": "product_version",
                "name": "8.0.5.1",
                "product": {
                  "name": "Open Source Ruby on Rails 8.0.5.1",
                  "product_id": "T057380-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rubyonrails:ruby_on_rails:8.0.5.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c8.1.3.1",
                "product": {
                  "name": "Open Source Ruby on Rails \u003c8.1.3.1",
                  "product_id": "T057381"
                }
              },
              {
                "category": "product_version",
                "name": "8.1.3.1",
                "product": {
                  "name": "Open Source Ruby on Rails 8.1.3.1",
                  "product_id": "T057381-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rubyonrails:ruby_on_rails:8.1.3.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "libvips \u003c8.13",
                "product": {
                  "name": "Open Source Ruby on Rails libvips \u003c8.13",
                  "product_id": "T057385"
                }
              },
              {
                "category": "product_version",
                "name": "libvips 8.13",
                "product": {
                  "name": "Open Source Ruby on Rails libvips 8.13",
                  "product_id": "T057385-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rubyonrails:ruby_on_rails:libvips__8.13"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Ruby on Rails"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-66066",
      "product_status": {
        "known_affected": [
          "T057380",
          "T057381",
          "T057385",
          "T057379"
        ]
      },
      "release_date": "2026-07-29T22:00:00.000+00:00",
      "title": "CVE-2026-66066"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Das IBM License Metric Tool dient der Lizenzverwaltung f\u00fcr IBM Produkte.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um beliebigen Programmcode auszuf\u00fchren, um einen Denial of Service Angriff durchzuf\u00fchren, um Informationen offenzulegen, um Dateien zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2958 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2958.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2958 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2958"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7284379 vom 2026-08-20",
        "url": "https://www.ibm.com/support/pages/node/7284379"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:63355 vom 2026-09-04",
        "url": "https://access.redhat.com/errata/RHSA-2026:63355"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7286522 vom 2026-09-07",
        "url": "https://www.ibm.com/support/pages/node/7286522"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7286986 vom 2026-09-10",
        "url": "https://www.ibm.com/support/pages/node/7286986"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM License Metric Tool: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-09-10T22:00:00.000+00:00",
      "generator": {
        "date": "2026-09-11T09:12:52.805+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2958",
      "initial_release_date": "2026-08-20T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-08-20T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-09-03T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-09-07T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-09-10T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM App Connect Enterprise",
            "product": {
              "name": "IBM App Connect Enterprise",
              "product_id": "T058846",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:app_connect_enterprise:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c9.2.44.2",
                "product": {
                  "name": "IBM License Metric Tool \u003c9.2.44.2",
                  "product_id": "T058467"
                }
              },
              {
                "category": "product_version",
                "name": "9.2.44.2",
                "product": {
                  "name": "IBM License Metric Tool 9.2.44.2",
                  "product_id": "T058467-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:license_metric_tool:9.2.44.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "License Metric Tool"
          },
          {
            "category": "product_name",
            "name": "IBM QRadar SIEM",
            "product": {
              "name": "IBM QRadar SIEM",
              "product_id": "T021415",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:qradar_siem:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-10842",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-10842"
    },
    {
      "cve": "CVE-2026-12185",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-12185"
    },
    {
      "cve": "CVE-2026-12802",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-12802"
    },
    {
      "cve": "CVE-2026-12803",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-12803"
    },
    {
      "cve": "CVE-2026-12816",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-12816"
    },
    {
      "cve": "CVE-2026-12860",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-12860"
    },
    {
      "cve": "CVE-2026-13506",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-13506"
    },
    {
      "cve": "CVE-2026-13586",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-13586"
    },
    {
      "cve": "CVE-2026-14682",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-14682"
    },
    {
      "cve": "CVE-2026-14981",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-14981"
    },
    {
      "cve": "CVE-2026-15055",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-15055"
    },
    {
      "cve": "CVE-2026-15064",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-15064"
    },
    {
      "cve": "CVE-2026-15325",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-15325"
    },
    {
      "cve": "CVE-2026-15328",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-15328"
    },
    {
      "cve": "CVE-2026-16243",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-16243"
    },
    {
      "cve": "CVE-2026-16439",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-16439"
    },
    {
      "cve": "CVE-2026-16441",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-16441"
    },
    {
      "cve": "CVE-2026-41254",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-41254"
    },
    {
      "cve": "CVE-2026-46917",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-46917"
    },
    {
      "cve": "CVE-2026-46968",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-46968"
    },
    {
      "cve": "CVE-2026-47010",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-47010"
    },
    {
      "cve": "CVE-2026-47021",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-47021"
    },
    {
      "cve": "CVE-2026-47027",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-47027"
    },
    {
      "cve": "CVE-2026-47057",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-47057"
    },
    {
      "cve": "CVE-2026-47058",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-47058"
    },
    {
      "cve": "CVE-2026-47059",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-47059"
    },
    {
      "cve": "CVE-2026-47063",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-47063"
    },
    {
      "cve": "CVE-2026-58059",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-58059"
    },
    {
      "cve": "CVE-2026-58060",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-58060"
    },
    {
      "cve": "CVE-2026-58061",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-58061"
    },
    {
      "cve": "CVE-2026-58062",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-58062"
    },
    {
      "cve": "CVE-2026-58063",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-58063"
    },
    {
      "cve": "CVE-2026-59639",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59639"
    },
    {
      "cve": "CVE-2026-59642",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59642"
    },
    {
      "cve": "CVE-2026-59645",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59645"
    },
    {
      "cve": "CVE-2026-59647",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59647"
    },
    {
      "cve": "CVE-2026-59648",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59648"
    },
    {
      "cve": "CVE-2026-59650",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59650"
    },
    {
      "cve": "CVE-2026-59651",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59651"
    },
    {
      "cve": "CVE-2026-59652",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-59652"
    },
    {
      "cve": "CVE-2026-60147",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-60147"
    },
    {
      "cve": "CVE-2026-66066",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-66066"
    },
    {
      "cve": "CVE-2026-67312",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-67312"
    },
    {
      "cve": "CVE-2026-67313",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-67313"
    },
    {
      "cve": "CVE-2026-67314",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-67314"
    },
    {
      "cve": "CVE-2026-67315",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-67315"
    },
    {
      "cve": "CVE-2026-67316",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-67316"
    },
    {
      "cve": "CVE-2026-67317",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-67317"
    },
    {
      "cve": "CVE-2026-67318",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-67318"
    },
    {
      "cve": "CVE-2026-67319",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-67319"
    },
    {
      "cve": "CVE-2026-67320",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-67320"
    },
    {
      "cve": "CVE-2026-67321",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-67321"
    },
    {
      "cve": "CVE-2026-8400",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-8400"
    },
    {
      "cve": "CVE-2026-8763",
      "product_status": {
        "known_affected": [
          "T058846",
          "67646",
          "T021415",
          "T058467"
        ]
      },
      "release_date": "2026-08-20T22:00:00.000+00:00",
      "title": "CVE-2026-8763"
    }
  ]
}