Vulnerability record · CVE-2018-1437 · published 14 March 2018

CVE-2018-1437: Ibm notes untrusted search path vulnerability

Ibm · Notes

IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability to DLL hijacking to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 139565.

7.8 CVSS 3.0 High EPSS 2.2% · top 17.8% CWE-426 · Untrusted search path

7.8CVSS 3.0 base score, v2 9.3

2.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Notes Ibm

References

Link	Tags
http://www.ibm.com/support/docview.wss?uid=swg22014201	PatchVendor Advisory
http://www.securityfocus.com/bid/103401	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040563	Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/139565	VDB EntryVendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22014201	PatchVendor Advisory
http://www.securityfocus.com/bid/103401	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040563	Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/139565	VDB EntryVendor Advisory

Track CVE-2018-1437 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2012-6277Ibm domino vulnerabilityMultiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Sy…EPSS 8.1%21 Feb 2020 7.8CVE-2018-1771Ibm domino memory buffer overflow vulnerabilityIBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command line arg…EPSS 0.48%20 Dec 2018 7.8CVE-2018-1435Ibm notes untrusted search path vulnerabilityIBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack. A remote attacker could trick a user to double click a malicious executable in an atta…EPSS 2.5%14 Mar 2018 7.8CVE-2018-1409Ibm notes vulnerabilityIBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command…EPSS 0.37%19 Feb 2018 7.8CVE-2018-1410Ibm notes vulnerabilityIBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command…EPSS 0.38%19 Feb 2018 7.8CVE-2018-1411Ibm notes vulnerabilityIBM Notes Diagnostics (IBM Client Application Access and IBM Notes) could allow a local user to execute commands on the system. By crafting a command…EPSS 0.37%19 Feb 2018 7.8CVE-2017-1711Ibm notes untrusted search path vulnerabilityIBM iNotes 8.5 and 9.0 SUService can be misguided into running malicious code from a DLL masquerading as a windows DLL in the temp directory. IBM X-F…EPSS 1.1%13 Feb 2018 7.8CVE-2017-1714Ibm notes vulnerabilityIBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege. IBM X-Force …EPSS 0.34%13 Feb 2018

Source: NIST National Vulnerability Database (record CVE-2018-1437), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.