CVE-2020-4427: IBM Data Risk Manager SAML authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable authentication bypass yielding full administrative access, with CVSS 9.8, KEV listing and very high EPSS.

What it is

IBM Data Risk Manager versions 2.0.1 through 2.0.6 can be configured with SAML authentication, and a specially crafted HTTP request bypasses that authentication. A successful bypass grants full administrative access to the system, making this a complete compromise of the application.

Impact

An unauthenticated remote attacker gains full administrative access to the IBM Data Risk Manager instance, allowing control over the application and any data it manages.

Attack surface

Reachable over the network via HTTP with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The flaw only applies when the product is configured to use SAML authentication.

Exploitation

Listed in CISA KEV since 2021-11-03 with a required action to apply vendor updates, and EPSS probability is 0.70031 (99.3rd percentile), indicating high likelihood of exploitation. No ransomware campaign use is documented in the record.

What to do

• Apply the vendor patch referenced in IBM support node 6206875 for the affected 2.0.x versions.
• If patching cannot be done immediately, restrict network access to the Data Risk Manager interface to trusted management networks only.
• Review SAML authentication configuration and validate that authentication cannot be bypassed by crafted requests.
• Monitor for and investigate any unexpected administrative account activity or configuration changes.
• Track CISA KEV remediation deadlines and confirm the instance is no longer exposed.

Detection

• Inspect web and reverse proxy logs for crafted HTTP requests to authentication or SAML endpoints that return administrative sessions without a valid login.
• Alert on new or unexpected administrative sessions and privilege changes in IBM Data Risk Manager audit logs.
• Correlate authentication events where a session is established without a preceding successful SAML assertion.
• Hunt for access to administrative functions from IPs that have not previously authenticated.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.