CVE-2024-22320: IBM Operational Decision Manager unsafe deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 8.8 with SYSTEM-level RCE and a very high EPSS score, tempered only by the requirement for authenticated access and no confirmed in-the-wild exploitation.

What it is

IBM Operational Decision Manager 8.10.3 deserializes untrusted data, allowing a remote authenticated attacker to execute arbitrary code by sending a specially crafted request. The flaw is a CWE-502 unsafe deserialization issue rated CVSS 8.8, and code runs in the context of SYSTEM, making it a serious post-authentication compromise path.

Impact

An attacker with valid credentials gains arbitrary code execution as SYSTEM on the affected server, leading to full host compromise, data theft, and potential lateral movement.

Attack surface

Reachable over the network via a crafted request to the ODM service; the CVSS vector shows PR:L and UI:N, so a low-privileged authenticated account is required and no user interaction is needed.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.734 (99.4th percentile), and a public write-up on exploiting the Java deserialization RCE exists, indicating meaningful exploitation interest.

What to do

• Apply the IBM fix referenced in IBM support page node/7112382 for ODM 8.10.3.
• Restrict network access to ODM endpoints to trusted hosts and management networks.
• Enforce least privilege and review accounts with access to the ODM service, since exploitation requires authentication.
• Monitor and, where feasible, block Java deserialization of untrusted input at the application or WAF layer.

Detection

• Hunt for ODM service processes spawning unexpected child processes such as cmd.exe, powershell.exe, or /bin/sh.
• Monitor for suspicious Java deserialization payload patterns or anomalous serialized objects in requests to ODM endpoints.
• Alert on ODM service accounts performing unusual file writes or outbound network connections.
• Review ODM application logs for malformed or unusually large request bodies preceding process creation events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.