CVE-2026-87800: CWE-434 Unrestricted Upload of File with Dangerous Type in IBM Cyber Fraud

CVE-2026-87800 describes a vulnerability in IBM Cyber Fraud versions 1.0.0 through 1.0.2 where an authenticated remote attacker can upload files of dangerous types without proper validation, leading to arbitrary code execution. The vulnerability is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with a scope change and high confidentiality impact but no integrity or availability impact.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the affected system, potentially compromising confidentiality. The attack requires authentication and user interaction, limiting the ease of exploitation. There is no impact on integrity or availability according to the CVSS vector.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict file upload permissions and validate file types where possible to mitigate risk.