← Vulnerability feed

Vulnerability record · CVE-2018-1435 · published 14 March 2018

CVE-2018-1435: Ibm notes untrusted search path vulnerability

Ibm · Notes

IBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack. A remote attacker could trick a user to double click a malicious executable in an attacker-controlled directory, which could result in code execution. IBM X-Force ID: 139563.

7.8 CVSS 3.0 High EPSS 2.5% · top 16.1% CWE-426 · Untrusted search path
7.8CVSS 3.0 base score, v2 6.8
2.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

IBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack. A remote attacker could trick a user to double click a malicious executable in an attacker-controlled directory, which could result in code execution. IBM X-Force ID: 139563.

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.ibm.com/support/docview.wss?uid=swg22014198 PatchVendor Advisory
http://www.securityfocus.com/bid/103404 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040563 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/139563 VDB EntryVendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22014198 PatchVendor Advisory
http://www.securityfocus.com/bid/103404 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040563 Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/139563 VDB EntryVendor Advisory

Track CVE-2018-1435 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2012-6277Ibm domino vulnerabilityMultiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Sy…EPSS 8.1%7.8CVE-2018-1771Ibm domino memory buffer overflow vulnerabilityIBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command line arg…EPSS 0.48%7.8CVE-2018-1437Ibm notes untrusted search path vulnerabilityIBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. …EPSS 2.2%7.8CVE-2018-1409Ibm notes vulnerabilityIBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command…EPSS 0.37%7.8CVE-2018-1410Ibm notes vulnerabilityIBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command…EPSS 0.38%7.8CVE-2018-1411Ibm notes vulnerabilityIBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command…EPSS 0.37%7.8CVE-2017-1711Ibm notes untrusted search path vulnerabilityIBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-F…EPSS 1.1%7.8CVE-2017-1714Ibm notes vulnerabilityIBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege. IBM X-Force …EPSS 0.34%

Source: NIST National Vulnerability Database (record CVE-2018-1435), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.