CVE-2019-4716: IBM Planning Analytics configuration overwrite leads to admin login and code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable code execution as root/SYSTEM, listed in CISA KEV with very high EPSS and public exploits.

What it is

IBM Planning Analytics 2.0.0 through 2.0.8 allows a configuration overwrite that lets an unauthenticated attacker log in as "admin" and then execute code as root or SYSTEM through TM1 scripting. The flaw is a code injection issue rated critical, and because it grants administrative access and OS-level execution, it is a severe risk to any exposed deployment.

Impact

An attacker gains administrative control of the Planning Analytics server and can execute arbitrary code with root or SYSTEM privileges, leading to full host compromise.

Attack surface

The vulnerability is network-reachable with no authentication and no user interaction required, per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any internet- or network-exposed Planning Analytics instance in the affected range is directly reachable.

Exploitation

CVE-2019-4716 is listed in CISA KEV (added 2021-11-03) and has a high EPSS probability of about 0.86 (99.7th percentile), and public exploit references exist, indicating active exploitation in the wild.

What to do

• Apply the vendor patch from IBM support page node/1127781 and upgrade Planning Analytics beyond 2.0.8.
• Restrict network access to the Planning Analytics/TM1 server so it is not exposed to untrusted networks.
• Change default or weak administrative credentials and enforce strong authentication.
• Monitor for unauthorized configuration changes to TM1/Planning Analytics server settings.
• Review and limit TM1 scripting privileges to reduce post-exploitation impact.

Detection

• Audit Planning Analytics/TM1 logs for unexpected admin logins or configuration overwrite events.
• Alert on creation or modification of TM1 scripts or processes that spawn OS commands.
• Monitor for child processes from the Planning Analytics service running as root or SYSTEM.
• Watch for anomalous network connections to the Planning Analytics server from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.