CVE-2016-8964

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-07-13 · updated 2026-06-17
Weakness: CWE-200

Description

IBM BigFix Inventory v9 9.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 118853.

Affected products

IBM Corporation BigFix Inventory: from 9.0 before 9.2.8 — fixed in 9.2.8
IBM License Metric Tool: from 9.0 before 9.2.8 — fixed in 9.2.8

How to fix

Upgrade to a fixed version: IBM Corporation BigFix Inventory 9.2.8; IBM License Metric Tool 9.2.8. Check the vendor advisory for mitigations.

References

http://www.ibm.com/support/docview.wss?uid=swg21995024
http://www.securityfocus.com/bid/99548
http://www.securitytracker.com/id/1038919
https://exchange.xforce.ibmcloud.com/vulnerabilities/118853
http://www.ibm.com/support/docview.wss?uid=swg21995024
http://www.securityfocus.com/bid/99548
http://www.securitytracker.com/id/1038919
https://exchange.xforce.ibmcloud.com/vulnerabilities/118853

Get alerted when CVE-2016-8964 or the next vulnerability affects your stack