Security Resilience

CVE-2026-14893

Published
28 July 2026
Modified
23 October 2026
CVSS Score v3.1 7.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
EPSS Score 0.0033 27th percentile
Risk Priority 54 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS, Forum of Incident Response and Security Teams (FIRST), epss.first.org. Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-14893 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Ibm (inferred from references). Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.

CWE(s)
CWE-1321

Related Threats

MITRE ATT&CK Enterprise Techniques

MITRE ATT&CK v20.0

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-8083Shared CWE-1321
CVE-2026-42232Shared CWE-1321
CVE-2024-34698Shared CWE-1321
CVE-2023-26158Shared CWE-1321
CVE-2024-29650Shared CWE-1321
CVE-2026-54756Shared CWE-1321
CVE-2023-38894Shared CWE-1321
CVE-2023-26102Shared CWE-1321
CVE-2025-62410Shared CWE-1321
CVE-2025-3193Shared CWE-1321

Affected Assets

Ibm
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.3.6

Mitigating Controls (NIST CSF 2.0)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→CSF cross-walk — links open the control.

PR.PS-06 mostly match
blocks

Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.

Mitigating Controls (ISO/IEC 27001:2022 Annex A)

Our mappings, derived directly from the weakness types (CWEs) cited in the NVD entry via our CWE→ISO cross-walk — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development catches prototype-pollution flaws before release.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.

A.8.32 Change management partial match
blocks

Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.

References