CVE catalog

CVE-2026-12085

IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive config

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.38% · Oct 25, 2026

IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpedevops_deployNot reported8.0.1.14fixed
Cpedevops_deployNot reported8.1.2.7fixed
Cpedevops_deployNot reported8.2.1.0fixed
Cpeurbancode_deployNot reported7.3.2.19fixed
Cpedevops_deployNot reported8.2.1.0fixed
Cpeurbancode_deployNot reported7.3.2.19fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpedevops_deploycpeNot reported8.0.1.14Not reportedNot reportedNot reported
Cpedevops_deploycpeNot reported8.1.2.7Not reportedNot reportedNot reported
Cpedevops_deploycpeNot reported8.2.1.0Not reportedNot reportedNot reported
Cpeurbancode_deploycpeNot reported7.3.2.19Not reportedNot reportedNot reported
Cpedevops_deploycpeNot reported8.2.1.0Not reportedNVD-CVE-2026-12085Not reported
Cpeurbancode_deploycpeNot reported7.3.2.19Not reportedNVD-CVE-2026-12085Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)]