IBM Operational Decision Manager Unauthenticated SQL Injection to RCE

Technical Analysis

CVE-2026-18658 (CVSS 9.8) affects multiple IBM ODM versions (8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, 9.5.0.0, 9.5.0.1, 9.6.0.0) and stems from improper sanitization of user-supplied input in a database-facing component, enabling classic SQL injection. Attackers can leverage database write functions (e.g., INTO OUTFILE-style primitives or stored procedure abuse) to drop a JSP/servlet-based web shell directly into the web root, then invoke it via HTTP to achieve arbitrary code execution under the application server's privileges. No authentication is required, meaning any internet- or intranet-exposed ODM decision server is a direct target for automated scanning and exploitation. Organizations that integrate ODM as a business-rules or decision-execution backend for AI agent pipelines (e.g., agents calling ODM APIs to evaluate rules, approvals, or eligibility logic) risk full compromise of that decision layer, allowing attackers to manipulate rule outputs, exfiltrate data flowing through the agent pipeline, or pivot from the compromised host into other agent infrastructure and credentials stored on the same network segment.

Affected Systems

IBM Operational Decision Manager versions 9.6.0.0, 9.5.0.1, 9.5.0.0, 9.0.0.1, 8.12.0.1, 8.11.1.0, and 8.11.0.1; specifically the Decision Server / Rule Execution Server and any exposed web application components with database connectivity.

Indicators of Compromise

• No public IOCs available at time of disclosure
• Monitor for anomalous JSP/servlet files written to ODM web root directories
• Unexpected database errors or SQL syntax anomalies in ODM application logs
• Unusual outbound connections from ODM decision server hosts

Remediation Steps

1. 1

   Apply Vendor Patch

   Upgrade to the IBM-released fixed version or apply the official interim fix for CVE-2026-18658 as soon as it is published; monitor IBM PSIRT advisories for patch availability.

2. 2

   Restrict Network Exposure

   Ensure ODM decision servers are not exposed to the public internet; place them behind a firewall/VPN and restrict access to known internal systems, including agent orchestration hosts.

3. 3

   Deploy WAF Rules

   Implement web application firewall signatures to detect and block SQL injection payloads targeting known ODM endpoints as a temporary compensating control.

4. 4

   Audit Web Root for Web Shells

   Scan the ODM application web root for unauthorized or unexpected files (JSP/servlet shells) and validate file integrity against known-good baselines.

5. 5

   Database Hardening

   Restrict the database account used by ODM to least-privilege permissions, disabling file write/stacked query capabilities where not required by application logic.

6. 6

   Credential Rotation

   If compromise is suspected, rotate all credentials and API keys accessible from the ODM host, including any used by connected AI agent or automation systems, and audit logs for lateral movement.