What’s Vulnerable › Vulnerabilities

CVE-2016-9693

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-03-07 · updated 2026-06-17
• Weakness: CWE-20

Description

IBM Business Process Manager 7.5, 8.0, and 8.5 has a file download capability that is vulnerable to a set of attacks. Ultimately, an attacker can cause an unauthenticated victim to download a malicious payload. An existing file type restriction can be bypassed so that the payload might be considered executable and cause damage on the victim's machine. IBM Reference #: 1998655.

Affected products

• IBM Business Process Manager: 7.5.0.0, 7.5.0.1, 7.5.1.0, 7.5.1.1, 7.5.1.2, 8.0.0.0 (+11)
• IBM Websphere: 7.2, 7.2.0.1, 7.2.0.2, 7.2.0.3, 7.2.0.4, 7.2.0.5

References

• http://www.securityfocus.com/bid/98074
• https://www.ibm.com/support/docview.wss?uid=swg21998655
• http://www.securityfocus.com/bid/98074
• https://www.ibm.com/support/docview.wss?uid=swg21998655

Get alerted when CVE-2016-9693 or the next vulnerability affects your stack