Skip to content
Edition of Sunday, November 8, 2026
Daily CISO

The five-minute briefing for security leaders.

Security vendor · Data security posture management · in CISA KEV

IBM in the CISA KEV catalog

CISA’s Known Exploited Vulnerabilities catalog lists 8 entries for IBM as of catalog version 2026.11.06, released November 6, 2026. The newest was added August 4, 2026, and the latest federal due date is August 7, 2026. CISA marks 2 of them as known ransomware use.

Updated

entries in the catalog
8
newest addition
August 4, 2026
latest federal due date
August 7, 2026
marked known ransomware use
2

Directory record

Website
www.ibm.com
Categories
Data security posture management (primary), Workforce IAM and SSO, Endpoint management and application control, AI governance
Headquarters
HQ not established
Founded
1911
Ownership
Ownership not established
Company record
IBM on CISO Tribune

Directory data as of November 8, 2026. What the company sells, and the source for every fact, is on its CISO Tribune page.

KEV entries, newest first

Filed by CISA under the name “IBM”. Each row links to the CVE’s NVD record; entries added in the last 45 days also link to their place on must-patch. The due date is CISA’s remediation deadline for federal civilian agencies, as the feed states it.

  1. Added August 4, 2026

    CVE-2026-9198 IBM Langflow Code Injection Vulnerability

    Langflow

    Due August 7, 2026

  2. Added February 21, 2023

    CVE-2022-47986 IBM Aspera Faspex Code Execution Vulnerability

    Aspera Faspex · known ransomware use

    Due March 14, 2023

  3. Added May 25, 2022

    CVE-2013-3993 IBM InfoSphere BigInsights Invalid Input Vulnerability

    InfoSphere BigInsights · known ransomware use

    Due June 15, 2022

  4. Added January 10, 2022

    CVE-2015-7450 IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.

    WebSphere Application Server and Server Hypervisor Edition

    Due July 10, 2022

  5. Added November 3, 2021

    CVE-2020-4430 IBM Data Risk Manager Directory Traversal Vulnerability

    Data Risk Manager

    Due May 3, 2022

  6. Added November 3, 2021

    CVE-2020-4428 IBM Data Risk Manager Remote Code Execution Vulnerability

    Data Risk Manager

    Due May 3, 2022

  7. Added November 3, 2021

    CVE-2020-4427 IBM Data Risk Manager Security Bypass Vulnerability

    Data Risk Manager

    Due May 3, 2022

  8. Added November 3, 2021

    CVE-2019-4716 IBM Planning Analytics Remote Code Execution Vulnerability

    Planning Analytics

    Due May 3, 2022

Snapshot of CISA’s feed taken November 7, 2026; the whole catalog is counted on the KEV tracker.

On Daily CISO, newest first

  1. Weekly archive · Aug 3 – Aug 9, 2026

    CISA Flags Three Actively Exploited Bugs in Langflow, N-able, and Tomcat

  2. Weekly archive · Aug 14 – Aug 20, 2023

    Colorado's Medicaid agency warns 4 million people after IBM's MOVEit server was breached

  3. Weekly archive · Jul 24 – Jul 30, 2023

    IBM puts the average breach at $4.45 million

  4. Weekly archive · Mar 27 – Apr 2, 2023

    Ransomware Actors Keep Exploiting IBM Aspera Faspex Flaw

  5. Weekly archive · Feb 20 – Feb 26, 2023

    CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog

  6. Weekly archive · Jul 25 – Jul 31, 2022

    IBM: Average Data Breach Cost Hits $4.35 Million

Sources

  1. Cybersecurity and Infrastructure Security Agency, KEV catalog · primary source
  2. Cybersecurity and Infrastructure Security Agency, KEV JSON feed (catalog version 2026.11.06), published November 6, 2026 · primary source
  3. CISO Tribune, vendor directory record for IBM, published November 8, 2026