{"id":"CVE-2026-9821","aliases":[],"cve":{"records":[{"id":"CVE-2026-9821","source":"ibm","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-05-28T11:27:43.155Z","published":"2026-11-13T21:34:23.559Z","modified":"2026-11-13T21:34:23.559Z"}],"publishers":[{"name":"ibm","role":"CNA","organizationId":"9a959283-ebb5-44b6-b705-dcc2bbced522","modified":"2026-11-13T21:34:23.559Z"}],"references":[{"url":"https://www.ibm.com/support/pages/node/7295966","tags":["vendor-advisory","patch"],"source":"ibm"}],"weaknesses":[{"id":"CWE-117","description":"CWE-117 Improper Output Neutralization for Logs","source":"ibm"}],"applicability":[],"prioritization":[]},"title":"IBM Cyber Fraud includes components with multiple known vulnerabilities","titleSource":"ibm","descriptionSource":"ibm","description":"IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.","score":5.3,"severity":"medium","published":"2026-11-13T21:34:23.559Z","modified":"2026-11-13T21:34:23.559Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"IBM","name":"Cyber Fraud","platforms":[],"versions":[{"version":"1.0.0","status":"affected","lessThanOrEqual":"1.1.0","versionType":"semver"}],"cpes":["cpe:2.3:a:ibm:cyber_fraud:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:cyber_fraud:1.1.0:*:*:*:*:*:*:*"],"source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-9821"}],"remediation":[{"text":"IBM strongly encourages customers to update their systems promptly.\n\n\n\nPlease upgrade to at least version 1.1.1 according to the following instructions:\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=installing-cyber-fraud \n\n\n\n https://www.ibm.com/docs/en/cyber-fraud/1.x?topic=upgrading-cyber-fraud","source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-9821"}],"references":["https://www.ibm.com/support/pages/node/7295966"],"sources":[{"name":"CVE","id":"CVE-2026-9821","modified":"2026-11-13T21:34:23.559Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-9821"}],"assessments":[{"source":"ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-11-13T22:15:06.332Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:40:32.333Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T22:50:33.789Z","attemptedAt":"2026-11-13T22:50:33.789Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-13T22:50:33.789Z","attemptedAt":"2026-11-13T22:50:33.789Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T22:50:33.789Z","attemptedAt":"2026-11-13T22:50:33.789Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T22:50:33.789Z","attemptedAt":"2026-11-13T22:50:33.789Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-9821","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9821","modified":"2026-11-13T22:17:27.720","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-11-13T22:50:33.789Z"},{"source":"ENISA EUVD","id":"EUVD-2026-125780","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125780","modified":"Nov 13, 2026, 9:34:23 PM","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-11-13T22:50:33.789Z"}],"aiSummary":{"text":"IBM Cyber Fraud versions 1.0.0 through 1.1.0 have a vulnerability that allows unauthorized users to inject data into log messages. This is due to improper neutralization of special elements when written to log files. An attacker would need access to the system to exploit this weakness.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T22:21:05.862Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-9821"}]}}