CVE-2026-12086
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedIBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy stores potentially sensitive information in log files that could be read by a local user.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceIBM UrbanCode Deploy and IBM DevOps Deploy versions store potentially sensitive information in log files that could be read by a local user with filesystem access. This is an information disclosure vulnerability where sensitive data (unspecified in the advisory) is being written to log files without proper protection.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data>= 8.0.0.0, < 8.0.1.14>= 8.1.0.0, < 8.1.2.7>= 8.2.0.0, < 8.2.1.0>= 7.2.0.0, < 7.2.3.24>= 7.3.0.0, < 7.3.2.19CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Local
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify if IBM UrbanCode Deploy or IBM DevOps Deploy is installedLook for the installation directory. Typical paths include /opt/ibm/ucd or /opt/ibm/dod, or check for the installation on Windows under C:\Program Files\ibm\ucd or C:\Program Files\ibm\dod. Also check for running processes with names like 'ibm-ucd' or 'ibm-dod'.Affected if The product is installed on the system
-
Determine the installed versionCheck the version file in the installation directory. For UrbanCode Deploy, look for a version.txt or about.html in the installation root. For DevOps Deploy, check the same locations or run: server/bin/dsac versionAffected if The version falls within the affected ranges: DevOps Deploy 8.0.0.0-8.0.1.13, 8.1.0.0-8.1.2.6, 8.2.0.0-8.2.0.x; UrbanCode Deploy 7.2.0.0-7.2.3.23, 7.3.0.0-7.3.2.18
-
Locate log directoriesCommon log paths: server/logs, var/log/ucd, var/log/dod, or logs/ subdirectory within the installation root. Check the conf/log4j.xml or conf/log4j2.xml configuration file for the configured log directory path.Affected if Log files exist in the expected locations
-
Check file permissions on log directoriesOn Linux/Unix: run 'ls -la' on the log directory to check owner, group, and world-readable permissions. On Windows: right-click the log folder, go to Properties > Security to view who has access.Affected if Log directory permissions allow read access for non-admin users (e.g., world-readable, or readable by users outside the admin group)
-
Inspect log file contents for sensitive dataUse 'grep -i' or search for common patterns like 'password', 'token', 'secret', 'key', 'credential' in the log files within the log directories identified above.Affected if Log files contain plaintext passwords, tokens, API keys, or other credentials
A user is affected if they have IBM UrbanCode Deploy or IBM DevOps Deploy installed with a version matching the affected ranges AND the log directory permissions allow unauthorized local users to read log files containing sensitive data.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped7.2.3.247.3.2.198.0.1.14
Restrict file system permissions on log directories to limit access to authorized administrators only; review and sanitize logs to prevent sensitive data from being written; implement log rotation with secure deletion of old logs.
IBM DevOps Deploy 8.0.1.14+, 8.1.2.7+, 8.2.1.0+ or IBM UrbanCode Deploy 7.2.3.24+, 7.3.2.19+ (specific version depends on your current major.minor branch)
- 1. Identify the currently installed IBM UrbanCode Deploy or DevOps Deploy version using the administration console or command line
- 2. For DevOps Deploy 8.0.x users: Upgrade to version 8.0.1.14 or later
- 3. For DevOps Deploy 8.1.x users: Upgrade to version 8.1.2.7 or later
- 4. For DevOps Deploy 8.2.x users: Upgrade to version 8.2.1.0 or later
- 5. For UrbanCode Deploy 7.2.x users: Upgrade to version 7.2.3.24 or later
- 6. For UrbanCode Deploy 7.3.x users: Upgrade to version 7.3.2.19 or later
- 7. After upgrading, review log file permissions to ensure only authorized administrators can access them
- 8. Audit existing log files for any sensitive information that may have been recorded and redact as necessary
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing2.0 h
- Review / QA2.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,848.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-12086 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-12086 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data