What’s Vulnerable › Vulnerabilities
CVE-2026-12085: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptable to an Insertion of Sensitive Information Into Sent Data vulnerability
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-30 · updated 2026-10-25
- Weakness: CWE-201
Description
IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.
Affected products
- IBM DevOps Deploy: from 8.0.0.0 before 8.0.1.14; from 8.1.0.0 before 8.1.2.7; from 8.2.0.0 before 8.2.1.0 — fixed in 8.0.1.14, 8.1.2.7, 8.2.1.0
- IBM UrbanCode Deploy: from 7.3.0.0 before 7.3.2.19 — fixed in 7.3.2.19
How to fix
Upgrade to a fixed version: IBM DevOps Deploy 8.0.1.14, 8.1.2.7, 8.2.1.0; IBM UrbanCode Deploy 7.3.2.19. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-12085 or the next vulnerability affects your stack