CVE-2026-5065 identifies a vulnerability in IBM Controller versions 11.0.1, 11.1.0, 11.1.1, and 11.1.2 where hard-coded credentials such as passwords or cryptographic keys are embedded within the product. These credentials are used for inbound authentication, outbound communication with external components, or encryption of internal data. The presence of hard-coded credentials can allow unauthorized access or compromise of the system if discovered by an attacker. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided.

The vulnerability allows potential attackers to leverage hard-coded credentials to gain unauthorized access or manipulate communications and data within IBM Controller, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the critical nature of this exposure. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting network access to affected IBM Controller instances and monitor for unusual activity related to authentication or communication channels that might use these credentials.