Advisory · CVE-2026-85457
Stack buffer overflow in IBM Planning Analytics can execute code
IBM Planning Analytics 2.0 and 2.1 has a stack-based buffer overflow that an authenticated remote attacker can use to execute arbitrary code. IBM rates it CVSS 3.1 8.1.
- Vendor
- IBM
- Product
- Planning Analytics
- Identifier / CWE
- CVE-2026-85457
CWE-121 - Action timing
- Immediate
Explain it like I’m five
Planning Analytics copies attacker input into a fixed-size stack buffer without checking the length, and the overflow can hand the attacker control.
- 01Sign in
An attacker with a valid Planning Analytics account reaches the affected function.
- 02Oversized input
The attacker sends input that overflows a stack-based buffer.
- 03Code executes
The overflow lets the attacker execute arbitrary code on the server.
What happened
IBM disclosed CVE-2026-85457 for Planning Analytics 2.0 and 2.1. A stack-based buffer overflow (CWE-121) lets an authenticated remote attacker execute arbitrary code.
No fixed version is named in the NVD record, so remediation follows the IBM bulletin rather than a version guess here.
What to do
- Inventory every Planning Analytics deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Planning Analytics while remediation is underway, especially for internet-facing instances.
- Review application and server logs for Planning Analytics process crashes, restart loops, and malformed oversized requests in server logs.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
A memory-corruption RCE in the same bulletin as two auth bypasses makes this Planning Analytics set a single urgent work item, not four small ones.