IBM: every exploited CVE on CISA KEV

All 8 IBM bugs attackers are confirmed to be using, with attack scores and free detection rules.

Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

IBM bugs on CISA’s exploited list

1 added in 2026.

6 of 8

remotely exploitable ones have a free VEDAS detection rule

2 don’t yet; see detection gaps.

are linked to ransomware

Every IBM vulnerability the US government has confirmed attackers are using, newest first, with each bug’s EPSS (predicted attack chance) and VEDAS (exploit evidence) scores and any free Nuclei or Suricata detection rule. US federal agencies must fix KEV-listed bugs by a deadline; everyone else should treat the list as “patch first”.

Added	CVE	Product	Bug	EPSS	VEDAS	Detection rule	Ransomware
2026-08-04	CVE-2026-9198	IBM Langflow	IBM Langflow Code Injection Vulnerability	0.29	0.99	Nuclei · Suricata	No
2023-02-21	CVE-2022-47986	IBM Aspera Faspex	IBM Aspera Faspex Code Execution Vulnerability	1.00	0.98	Nuclei · Suricata	Yes
2022-05-25	CVE-2013-3993	IBM InfoSphere BigInsights	IBM InfoSphere BigInsights Invalid Input Vulnerability	0.05	0.53	None yet	Yes
2022-01-10	CVE-2015-7450	IBM WebSphere Application Server and Server Hypervisor Edition	IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.	0.98	0.99	Nuclei · Suricata	No
2021-11-03	CVE-2020-4430	IBM Data Risk Manager	IBM Data Risk Manager Directory Traversal Vulnerability	0.69	0.93	None yet	No
2021-11-03	CVE-2020-4428	IBM Data Risk Manager	IBM Data Risk Manager Remote Code Execution Vulnerability	0.62	0.98	Nuclei · Suricata	No
2021-11-03	CVE-2020-4427	IBM Data Risk Manager	IBM Data Risk Manager Security Bypass Vulnerability	0.70	0.98	Nuclei · Suricata	No
2021-11-03	CVE-2019-4716	IBM Planning Analytics	IBM Planning Analytics Remote Code Execution Vulnerability	0.86	0.99	Nuclei · Suricata	No

Industry partners