CVE-2026-12085
Full vulnerability record from the local CVENow database.
Description
IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.
Severity
MEDIUM
CVSS score
6.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-30 20:17:28.547000
Last modified
2026-10-25 21:10:00.770000
View original CVE JSON
{
"id": "CVE-2026-12085",
"sourceIdentifier": "[email protected]",
"published": "2026-06-30T20:17:28.547",
"lastModified": "2026-10-25T21:10:00.770",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system."
},
{
"lang": "es",
"value": "IBM UCD - IBM UrbanCode Deploy 7.3 hasta 7.3.2.18 y IBM UCD - IBM DevOps Deploy 8.0 hasta 8.0.1.13, 8.1 hasta 8.1.2.6, y 8.2 hasta 8.2.1.0 IBM DevOps Deploy podría divulgar configuraciones sensibles y secretos a usuarios autenticados en respuestas de la API que podrían ser utilizados en ataques posteriores contra el sistema."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "IBM",
"product": "UCD - IBM UrbanCode Deploy",
"cpes": [
"cpe:2.3:a:ibm:ucd___ibm_urbancode_deploy:7.3:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:ucd___ibm_urbancode_deploy:7.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:ucd___ibm_urbancode_deploy:7.3.2.18:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "7.3.0",
"lessThanOrEqual": "7.3.2.18",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "IBM",
"product": "UCD - IBM DevOps Deploy",
"cpes": [
"cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.0.1.13:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.1:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.1.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.2:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:ucd___ibm_devops_deploy:8.2.1.0:*:*:*:*:*:*:*"
],
"versions": [
{
"version": "8.0",
"lessThanOrEqual": "8.0.1.13",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.1.0",
"lessThanOrEqual": "8.1.2.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.2.0",
"lessThanOrEqual": "8.2.1.0",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-01T14:01:22.988510Z",
"id": "CVE-2026-12085",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-201"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:devops_deploy:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.0.0.0",
"versionEndExcluding": "8.0.1.14",
"matchCriteriaId": "26D9E998-DB17-4A71-9452-A26614168759"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:devops_deploy:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.1.0.0",
"versionEndExcluding": "8.1.2.7",
"matchCriteriaId": "45A6D038-C474-4482-9F59-0152D621ADB9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:devops_deploy:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.2.0.0",
"versionEndExcluding": "8.2.1.0",
"matchCriteriaId": "01BE7813-5F11-468B-8DFD-58FF3D46D89A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ibm:urbancode_deploy:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.3.0.0",
"versionEndExcluding": "7.3.2.19",
"matchCriteriaId": "455A02FB-5A16-4E9D-969E-054CF62C44D6"
}
]
}
]
}
],
"references": [
{
"url": "https://www.ibm.com/support/pages/node/7277577",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}