CVE-2026-12084 Misconfiguration in UCD - IBM DevOps Deploy
Attackers can exploit permissive CORS settings to perform privileged actions and access sensitive data in IBM DevOps Deploy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-12084?
CVE-2026-12084 is a medium-severity vulnerability in UCD - IBM DevOps Deploy, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains.
Weakness: CWE-942
Which versions are affected by CVE-2026-12084?
It affects 1 product.
Products include Ibm Devops Deploy.
How do I fix CVE-2026-12084?
No fix has been published for CVE-2026-12084 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-12084 being exploited?
There is no known exploitation of CVE-2026-12084 in the wild and no public exploit code.
Other vulnerabilities in UCD - IBM DevOps Deploy
- CVE-2024-55904 IBM DevOps Deploy / IBM UrbanCode Deploy command injection
- CVE-2026-12085 Information disclosure in UCD - IBM DevOps Deploy
- CVE-2025-14148 IBM DevOps Deploy is susceptible to a Insufficiently Protected Credentials vulnerability
- CVE-2024-56469 IBM UrbanCode Deploy (UCD) / IBM DevOps Deploy missing authentication
- CVE-2024-22358 IBM UrbanCode Deploy session fixation
Sources
Also known as GHSA-fq2g-wf56-3prg.