CVE-2026-1726
Last modified
CVE-2026-1726 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 enables privilege escalation, allowing unauthorized users to perform administrative operations after being demoted. Attackers could access sensitive data, modify system configurations, or change permissions for other users. EPSS estimates a 0.19% chance of exploitation in the next 30 days.
Description
IBM Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2, 4.2.1, 5.0, and 5.1 enables privilege escalation, allowing unauthorized users to perform administrative operations after being demoted. Attackers could access sensitive data, modify system configurations, or change permissions for other users. The issue undermines administrative controls and could lead to data breaches, system compromise, and loss of trust in the application's security mechanisms.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Guardium Key Lifecycle Manager | 4.1.0 |
| Ibm | Guardium Key Lifecycle Manager | 4.1.1 |
| Ibm | Guardium Key Lifecycle Manager | 4.2.0 |
| Ibm | Guardium Key Lifecycle Manager | 4.2.1 |
| Ibm | Guardium Key Lifecycle Manager | 5.0.0 |
| Ibm | Guardium Key Lifecycle Manager | 5.1.0 |
References
- https://www.ibm.com/support/pages/node/7268697Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-1726?
How severe is CVE-2026-1726?
How do I fix CVE-2026-1726?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1720The WowOptin: Next-Gen Popup Maker – Create Stunning Popups …8.8
- CVE-2026-1721Summary A Reflected Cross-Site Scripting (XSS) vulnerabilit…6.2
- CVE-2026-1722The WCFM Marketplace – Multivendor Marketplace for WooCommer…5.3
- CVE-2026-1723Improper Neutralization of Special Elements used in an OS Co…9.2
- CVE-2026-1724GitLab has remediated an issue in GitLab EE affecting all ve…7.5
- CVE-2026-1725GitLab has remediated an issue in GitLab CE/EE affecting ver…7.5
- CVE-2026-17264Opening a crafted DICOM file containing malicious JPEG-compr…5.3
- CVE-2026-1727The Agentspace service was affected by a vulnerability that …9.1
- CVE-2026-1728Tokens issued to a low-privileged user are not sufficiently …9.8
- CVE-2026-1729The AdForest theme for WordPress is vulnerable to authentica…9.8
- CVE-2026-1730The OS DataHub Maps plugin for WordPress is vulnerable to ar…8.8
- CVE-2026-1731BeyondTrust Remote Support (RS) and certain older versions o…9.8
Are you affected by CVE-2026-1726?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST