[NEW] [high] IBM License Metric Tool: Multiple vulnerabilities

CSIRTS triage

What

Multiple vulnerabilities in IBM License Metric Tool enable remote code execution, denial of service, information disclosure, file manipulation, and security bypass.

Who is affected

Deployments of IBM License Metric Tool are affected.

Urgency

High priority; multiple CVEs with RCE capability require immediate remediation.

Action

Apply IBM security patches for CVE-2026-10842, CVE-2026-12185, CVE-2026-12802, CVE-2026-12803, CVE-2026-12816, CVE-2026-12860, CVE-2026-13506, and CVE-2026-13586.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

CERT-Bund (BSI) Security Advisories (DE · national-cert · site)

Severity

high

Published

2026-08-21

Exploitation

Not in CISA KEV at last sync

Language

Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2958

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Low exploitation riskCVE-2026-108420.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-121850.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-128020.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-128030.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-128160.17% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-128600.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-135060.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-135860.31% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 23% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-146820.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.
• Low exploitation riskCVE-2026-149810.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.

Referenced CVEs

+6 more CVEs referenced in this advisory.

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• high[NEW] [high] IBM WebSphere Application Server and Application Server Liberty: Multiple vulnerabilitiescert-bund
• medium[NEW] [medium] IBM WebSphere Application Server: Vulnerability allows bypassing security measurescert-bund
• unknownNCSC-2026-0325 [1.00] [M/H] Vulnerabilities patched in Atlassian productsncsc-nl
• medium[NEW] [medium] Oracle Java SE: Multiple vulnerabilitiescert-bund
• unknownNCSC-2026-0321 [1.00] [M/H] Multiple vulnerabilities fixed in IBM AIX and IBM PowerVM VIOSncsc-nl
• high[NEW] [high] IBM AIX and VIOS: Multiple vulnerabilitiescert-bund
• unknownexploitedMultiple vulnerabilities in IBM products (August 21, 2026)cert-fr-avis
• highexploited[NEW] [high] Atlassian Products (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, and Jira): Multiple vulnera…cert-bund
• high[NEW] [high] IBM App Connect Enterprise: Multiple vulnerabilitiescert-bund
• medium[NEW] [medium] RealObjects PDFreactor: Multiple vulnerabilities enable unspecified attackcert-bund
• high[NEW] [high] Bouncy Castle: Multiple vulnerabilitiescert-bund
• unknownexploitedMultiple vulnerabilities in IBM products (August 14, 2026)cert-fr-avis

More from CERT-Bund (BSI) Security Advisories

• high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
• medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
• medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
• high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25