CVE-2023-49886 | IBM Standards Processing Engine 10.0.1.10 could allow a remo… | CVSS 9.8 CRITICAL

Description

IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java deserialization. By sending specially crafted input, an attacker could exploit this vulnerability to execute arbitrary code on the system.

Metadata

CVE ID: CVE-2023-49886
State: PUBLISHED
Assigner: ibm
Reserved: 2023-12-01 01:47 UTC
Published: 2025-10-06 14:47 UTC
Last updated: 2026-02-26 17:48 UTC
Primary CWE: CWE-502
CWE-502 Deserialization of Untrusted Data
Vendor / Product: IBM / Transformation Extender Advanced
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
IBM	Transformation Extender Advanced	—	10.0.1.10

Weakness (CWE)

CWE	Source	Description
CWE-502	cna	CWE-502 Deserialization of Untrusted Data

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (1)

https://www.ibm.com/support/pages/node/7247179