CVE-2026-8636

MEDIUM

IBM Datacap and Navigator - Password and Key Disclosure from Memory

Title source: manual
STIX 2.1

Description

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
https://www.ibm.com/support/pages/node/7276609

Scores

CVSS v3 5.5
EPSS 0.0015
EPSS Percentile 4.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-316
Status published
Products (12)
ibm/datacap 9.1.7
ibm/datacap 9.1.8
ibm/datacap 9.1.9
IBM/Datacap 9.1.7 - 1.8.4
IBM/Datacap 9.1.8
IBM/Datacap 9.1.9
IBM/Datacap Navigator 9.1.7 - 8.2.1.0
IBM/Datacap Navigator 9.1.8
IBM/Datacap Navigator 9.1.9
ibm/datacap_navigator 9.1.7
... and 2 more
Published Jun 22, 2026
Tracked Since Jun 22, 2026