CVE-2026-12084: devops deploy from 8.1.0.0 (inclusive), before 8.1.2.7 (exclusive), from 8.2.0.0 (inclusive), before 8.2.2.0…

Affected technology

devops deploy · from 8.1.0.0 (inclusive), before 8.1.2.7 (exclusive)
ibm

devops deploy · from 8.2.0.0 (inclusive), before 8.2.2.0 (exclusive)
ibm

UCD - IBM DevOps Deploy · 8.1.0 through 8.1.2.6, 8.2.0 through 8.2.1.0
IBM

Description’s affected range: through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource Sharing (CORS) which could

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker could carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. Vendor/CNA’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality impact as high; integrity and availability impact as none.