CVE-2026-9745 Vulnerabilities exists in IBM Netezza Software
Remote attackers can redirect application requests to unintended S3 buckets due to missing ownership validation, potentially accessing or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9745?
CVE-2026-9745 is a medium-severity server-side request forgery vulnerability in IBM Netezza Software, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an unintended S3 bucket under their control.
Weakness: CWE-283
Which versions are affected by CVE-2026-9745?
It affects 1 product.
Products include Ibm Netezza Performance Server.
How do I fix CVE-2026-9745?
No fix has been published for CVE-2026-9745 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-9745 being exploited?
There is no known exploitation of CVE-2026-9745 in the wild and no public exploit code.
Other vulnerabilities in IBM Netezza Software
Sources
Also known as GHSA-fm22-x7f3-gcr6.