CVE-2020-4428VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-4428: IBM Data Risk Manager Remote Code Execution Vulnerability

Affects IBM Data Risk ManagerSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 61.7% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-4428 (opens in a new tab)

Description

CVE-2020-4428 is a high-severity vulnerability in IBM Data Risk Manager that allows a remote, authenticated attacker to execute arbitrary commands on the affected system. The vulnerability is related to improper input handling that could lead to command injection (CWE-78). Exploits for this vulnerability have been observed in the wild. No specific affected versions or patch information is provided in the available data.

Summary

IBM Data Risk Manager contains an unspecified vulnerability (CVE-2020-4428) that enables remote authenticated attackers to execute arbitrary commands on the system. The vulnerability is categorized under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Exploitation requires authentication, and active exploitation has been reported. No detailed technical specifics or patch information are provided in the source data.

Impact

Successful exploitation allows remote authenticated attackers to execute arbitrary commands on the affected IBM Data Risk Manager system, potentially leading to full system compromise or unauthorized control over the application environment. This can result in data breaches, system disruption, or further lateral movement within the network.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to IBM Data Risk Manager to trusted users only and monitor for suspicious activity. Follow IBM's official advisories for updates and apply patches as soon as they are released.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:20:37 UTC

Weaknesses

References

Related threats