High priorityDisclosed

Advisory · CVE-2026-107400

IBM TRIRIGA Application Platform improper authentication can give an authenticated attacker code execution

IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper authentication. CVSS 3.1 8.8.

Advisory published October 20, 2026Independent summary
Vendor
IBM
Product
IBM TRIRIGA Application Platform
Identifier / CWE
CVE-2026-107400
CWE-287
Action timing
Immediate
ELI5

Explain it like I’m five

A logged-in TRIRIGA user can use an authentication flaw to run arbitrary code on the platform server, well beyond what their account should allow.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Authenticated session held

    An attacker holds valid TRIRIGA credentials and network access to the platform.

  2. 02Authentication flaw used

    The attacker uses the improper authentication flaw (CWE-287) in the affected release.

  3. 03Code execution

    Per IBM, the attacker can execute arbitrary code on the platform.

What happened

IBM PSIRT disclosed CVE-2026-107400: IBM TRIRIGA Application Platform could allow a remote authenticated attacker to execute arbitrary code due to improper authentication (CWE-287). The CVSS 3.1 score is 8.8, with low privileges required and no user interaction.

Per the vendor affected data in the NVD record, affected releases are 5.0.0 through 5.0.8. No fixed version is stated in the NVD record itself; IBM’s bulletin is the reference for the fix.

What to do

  1. Inventory IBM TRIRIGA Application Platform deployments and note the version of each.
  2. Apply the fix for your release line from IBM security bulletin 7292418; the NVD record lists the affected ranges, so confirm your line against the bulletin rather than assuming a fixed version.
  3. Restrict access to trusted networks and named users while remediation is underway.
  4. Hunt for unexpected code or process behaviour on TRIRIGA servers, unfamiliar jobs or integrations, and authentication events that do not match named user activity.
  5. Verify the deployed fix level after updating, not just that an update ran.

Management note

TRIRIGA runs facilities, lease, and workplace operations and is often integrated with identity and building systems. Authenticated code execution on it is a server compromise, not an application bug, so patch on the urgent ring and review account access.