CVE-2026-8862

HighCVSS 7.5/10Last modified Sep 10, 2026

Description

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. The exposed secret enables attackers to pull private container images, potentially revealing proprietary code, configuration details, and other sensitive information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
IBM	Netezza Software	>= 11.3.0.3, <= Interim Fix 002

References

https://www.ibm.com/support/pages/node/7284359Patch, Vendor Advisory

Timeline

Published: Sep 3, 2026
Last modified: Sep 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-886204.3SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The en CVE-2026-886212.7OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated CVE-2026-886228.8NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.CVE-2026-886237.5NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is recei CVE-2026-886249.1Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory dele CVE-2026-88637.8Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the abili CVE-2026-88647.3The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Control App has been released CVE-2026-886476.5GnuTLS v3.8.13 can perhaps unexpectedly trust a certificate on the basis of Common Name when Subject Alternative Name has an SRV otherName (CVE-2026-886483.7In GnuTLS v3.8.13, an excluded msUPN/SRV otherName is never checked. NOTE: the Supplier does not consider this an actionable security vulner CVE-2026-88656.4The Avalon23 Products Filter for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'avalon23_qr' shortco CVE-2026-88666.4The jQuery googleslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'googleslides' shortcode in all versions u CVE-2026-88676.4The Post Category Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'postcategorygallery' shortcode