CVE-2019-4716VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2019-4716: IBM Planning Analytics Remote Code Execution Vulnerability

Affects IBM Planning AnalyticsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 86.4% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-4716 (opens in a new tab)

Description

IBM Planning Analytics contains a vulnerability (CVE-2019-4716) that allows an unauthenticated attacker to overwrite configuration settings, enabling login as the 'admin' user. This access permits execution of arbitrary code with root or SYSTEM privileges via TM1 scripting. The vulnerability has been exploited in the wild and is rated as high severity.

Summary

CVE-2019-4716 is a remote code execution vulnerability in IBM Planning Analytics caused by a configuration overwrite flaw. An unauthenticated attacker can leverage this flaw to log in as the 'admin' user and execute code with elevated privileges (root or SYSTEM) through TM1 scripting capabilities. This vulnerability has been observed to be exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

Impact

Successful exploitation grants an unauthenticated attacker administrative access and the ability to execute arbitrary code with root or SYSTEM privileges on the affected system. This can lead to full system compromise, data theft, or disruption of service.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to IBM Planning Analytics instances and monitor for suspicious activity related to TM1 scripting. Follow IBM's official security advisories for updates.

Weaknesses

CWE-94Code Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:20:34 UTC

Weaknesses

References

Related threats