Advisory · CVE-2026-110273
IBM TRIRIGA code injection can run arbitrary code on the server
IBM TRIRIGA Application Platform 5.0.0 through 5.0.9 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command, rated high at CVSS 8.8.
- Vendor
- IBM
- Product
- TRIRIGA Application Platform
- Identifier / CWE
- CVE-2026-110273
CWE-94 - Action timing
- Immediate
Explain it like I’m five
TRIRIGA builds operating system commands from user input without neutralizing the special characters that give commands their meaning. A logged-in attacker can smuggle in their own commands, and the server runs them.
- 01Authenticated access
A remote authenticated attacker reaches TRIRIGA.
- 02Special elements supplied
Input carries special elements used in an OS command.
- 03Neutralization skipped
The input is used in a command without proper neutralization.
- 04Code executed
Arbitrary code runs on the server.
What happened
IBM TRIRIGA Application Platform 5.0.0 through 5.0.9 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. The record rates it high at CVSS 8.8 under version 3.1, with network attack vector, low complexity, low privileges required, and no user interaction.
IBM’s bulletin lists the affected versions and the fix. Authenticated code execution still hands the attacker the server.
What to do
- Inventory TRIRIGA deployments and record each version.
- Check the IBM bulletin for the fix and apply it.
- Review host and application logs for unexpected command execution.
- Treat the host as potentially compromised if exploitation cannot be excluded.
- Verify the deployed version after updating.
Management note
Authenticated or not, arbitrary code execution on the server is a full compromise. Check the logs for the window before the patch.