CVE-2026-12086 is a vulnerability in IBM UrbanCode Deploy and IBM DevOps Deploy products where sensitive information is written to log files. These logs may be accessible to local users, potentially exposing confidential data. The affected versions include IBM UrbanCode Deploy 7.2 through 7.2.3.23, 7.3 through 7.3.2.18, and IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0. The vulnerability is categorized under CWE-532, indicating improper handling of sensitive information in logs. The CVSS score of 6.2 reflects a medium impact primarily on confidentiality. There is no vendor advisory or patch information available at this time, and no known exploits have been reported.

The vulnerability allows potentially sensitive information to be stored in log files accessible by local users. This could lead to unauthorized disclosure of confidential data. The integrity and availability of the system are not impacted. The CVSS vector indicates low attack complexity and no required privileges or user interaction, but the attack vector is local access only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local user access to log files to prevent unauthorized reading of sensitive information. Monitor IBM's official channels for updates or patches addressing this issue.