Cyber Resilience

CVE-2026-9610

Ibm Datacap 9.1.7 … 9.1.9

Published
22 June 2026
Modified
26 June 2026
Patch / advisory
CVSS Score v3.1 2.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0019 9th percentile
Risk Priority 15 floored blend · peak EPSS

Summary

CVE-2026-9610 is a low-severity Forced Browsing (CWE-425) vulnerability in Ibm Datacap. Its CVSS base score is 2.3 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked in the UI but is accessible by directly requesting the URL, bypassing intended access controls.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Direct URL access bypasses access controls on a public-facing IBM Datacap web application (CWE-425).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Direct URL access to unlinked resources bypasses UI-enforced controls, enabling exploitation of a public-facing web application.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-39729Same product: Ibm Datacap
CVE-2026-8059Same product: Ibm Datacap
CVE-2024-39737Same product: Ibm Datacap
CVE-2024-39741Same product: Ibm Datacap
CVE-2025-36026Same product: Ibm Datacap
CVE-2026-8636Same product: Ibm Datacap
CVE-2024-39739Same product: Ibm Datacap
CVE-2025-36027Same product: Ibm Datacap
CVE-2024-39730Same product: Ibm Datacap
CVE-2024-39740Same product: Ibm Datacap

Affected Assets

ibm
datacap
9.1.7, 9.1.8, 9.1.9
ibm
datacap navigator
9.1.7, 9.1.8, 9.1.9

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-4 Information Flow Enforcement
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces authorization checks on every requested resource/URL so that hidden endpoints cannot be accessed by forced browsing.

prevent

Enforces information-flow rules on URL paths and resource requests, blocking unauthorized direct access that bypasses UI-linked controls.

prevent

Boundary-protection mechanisms (e.g., WAF rules, URL ACLs) can deny direct requests to non-public application resources.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Directly requires policy-driven definition, enforcement, and review of authorizations on resources such as URLs.

PR.IR-01 mostly match
prevents

Protects environments from unauthorized logical access, which includes preventing direct requests to restricted paths.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect forced-browsing flaws, but the control itself does not prevent them in production.

prevents

Information access restriction implements the technical enforcement that directly blocks unauthorized direct requests.

prevents

Access control policy directly requires authorization checks on all resources, preventing forced browsing.

degrades

Managing access rights ensures every URL/script/file is explicitly authorized, mitigating direct request attacks.

degrades

Privileged access rights control enforces least-privilege checks on restricted endpoints.

prevents

Secure SDLC can include authorization design, yet the control itself does not guarantee runtime enforcement.

References