CVE-2026-19622 is a high severity authentication bypass (CVSS 8.8) in IBM Planning Analytics 2.0 and 2.1. A remote attacker could bypass authentication and escalate privileges because sub-requests are not validated properly. IBM's bulletin 7291604 describes the fix, so check it for your version and apply the update.
What's affected
The record lists IBM Planning Analytics 2.0 and 2.1. It does not list fixed versions, so take them from IBM's bulletin. The record's vector shows a low privilege requirement, so an account of some kind is involved.
How to check if you're exposed
Check your Planning Analytics version from the product's About page or your deployment records, and compare it with IBM's bulletin for the fix level.
Safeguard's free dependency scan at gold.safeguard.sh/scan reads manifests and lock files, so it will not see device firmware or an installed appliance. Use it for the application dependencies around this product, and use the vendor's own version check for the product itself.
What to do now
- List Planning Analytics installs and versions.
- Read IBM's bulletin and apply the fix.
- Limit network access to the service to the users and systems that need it.
- Review accounts with elevated roles for unexpected changes.
Why it matters
The weakness is CWE-288, authentication bypass using an alternate path or channel. The record points at improper validation of sub-requests: a request nested inside another is handled without the same checks.
The consequence is privilege escalation with high impact on confidentiality, integrity and availability, per the vector. Planning tools hold budget and forecast data, so access control failures matter. The CVE is not in CISA's KEV list.
Quick check
Do I need an account first?
The vector lists low privileges required.
Where is the fixed version?
In IBM's bulletin.
Sources
Last reviewed: 19 October 2026.
