CVE-2026-13365: 
IBM Planning Analytics vulnerability analysis and mitigation

CVE-2026-13365 is a Cross-Site Request Forgery (CSRF) vulnerability in IBM Planning Analytics Local versions 2.0.0 through 2.1.22. It allows unauthenticated attackers to execute malicious and unauthorized actions by tricking an authenticated user into submitting crafted requests to the application. The vulnerability was published on August 13, 2026, and a patch was made available on August 17, 2026. It carries a CVSS v3.1 base score of 6.5 (High) per NVD, and 7.1 (High) per ENISA (IBM Advisory).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the application fails to verify that state-changing requests originate from a legitimate, authenticated session rather than a third-party site. An attacker crafts a malicious webpage or link that, when visited by an authenticated Planning Analytics user, causes the user's browser to send unauthorized requests to the Planning Analytics application on the attacker's behalf. No special privileges are required by the attacker, but user interaction (the victim visiting a malicious page while authenticated) is a prerequisite. The attack vector is network-based with low complexity (IBM Advisory).

Successful exploitation allows an unauthenticated attacker to perform unauthorized modifications to the IBM Planning Analytics Local application through the session of a trusted, authenticated user. The primary impact is on integrity (CVSS integrity impact: High), as the attacker can manipulate application data or configurations without the user's knowledge. Confidentiality and availability are not directly impacted per the NVD CVSS scoring, though ENISA's scoring also notes a low availability impact (IBM Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.112%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable (IBM Advisory).

1. Reconnaissance: Identify IBM Planning Analytics Local deployments (versions 2.0.0–2.1.22) accessible via the network, using passive reconnaissance or organizational knowledge.
2. Craft malicious payload: Create an HTML page or link containing a forged HTTP request (e.g., a hidden form or JavaScript fetch) targeting a state-changing endpoint in the Planning Analytics application, such as modifying user data or application settings.
3. Deliver to victim: Distribute the malicious link or page to an authenticated Planning Analytics user via phishing email, social engineering, or embedding in a trusted-looking site.
4. Trigger the request: When the authenticated victim visits the malicious page, their browser automatically sends the forged request to the Planning Analytics server, including the victim's valid session cookies.
5. Achieve unauthorized action: The server processes the request as if it were legitimate, executing the attacker-specified action (e.g., data modification, configuration change) under the victim's identity (IBM Advisory).

IBM has released a patch addressing this vulnerability; users should upgrade IBM Planning Analytics Local to version 2.1.23 or later. As interim mitigations, administrators should implement anti-CSRF tokens on all state-changing requests, enforce the SameSite=Strict or SameSite=Lax attribute on session cookies, and educate users to avoid clicking suspicious links or visiting untrusted websites while authenticated to Planning Analytics. The official patch and further guidance are available via the IBM support page (IBM Advisory).