CVE catalog

CVE-2026-12086

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy store

[CVE catalog]

Severity
Medium · CVSS 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.14% · Oct 25, 2026

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy stores potentially sensitive information in log files that could be read by a local user.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpedevops_deployNot reported8.0.1.14fixed
Cpedevops_deployNot reported8.1.2.7fixed
Cpedevops_deployNot reported8.2.1.0fixed
Cpeurbancode_deployNot reported7.2.3.24fixed
Cpeurbancode_deployNot reported7.3.2.19fixed
Cpedevops_deployNot reported8.2.1.0fixed
Cpeurbancode_deployNot reported7.3.2.19fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpedevops_deploycpeNot reported8.0.1.14Not reportedNot reportedNot reported
Cpedevops_deploycpeNot reported8.1.2.7Not reportedNot reportedNot reported
Cpedevops_deploycpeNot reported8.2.1.0Not reportedNot reportedNot reported
Cpeurbancode_deploycpeNot reported7.2.3.24Not reportedNot reportedNot reported
Cpeurbancode_deploycpeNot reported7.3.2.19Not reportedNot reportedNot reported
Cpedevops_deploycpeNot reported8.2.1.0Not reportedNVD-CVE-2026-12086Not reported
Cpeurbancode_deploycpeNot reported7.3.2.19Not reportedNVD-CVE-2026-12086Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [National Vulnerability Database (NVD)]