CVE-2026-8636
published 2026-06-22CVE-2026-8636: IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from…
PriorityP345high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.20%
9.5th percentile
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | datacap | — | — |
| ibm | datacap | — | — |
| ibm | datacap | — | — |
| ibm | datacap | 9.1.7 – 1.8.4 | — |
| ibm | datacap_navigator | — | — |
| ibm | datacap_navigator | — | — |
| ibm | datacap_navigator | — | — |
| ibm | datacap_navigator | 9.1.7 – 8.2.1.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
IBM Datacap/Datacap Navigator up to 1.8.4/9.1.8/9.1.9 User Password cleartext storage in memory
vuldb·2026-06-22·CVSS 5.5
CVE-2026-8636 [MEDIUM] IBM Datacap/Datacap Navigator up to 1.8.4/9.1.8/9.1.9 User Password cleartext storage in memory
A vulnerability identified as problematic has been detected in IBM Datacap and Datacap Navigator up to 1.8.4/9.1.8/9.1.9. This issue affects some unknown processing of the component User Password Handler. Performing a manipulation results in cleartext storage of sensitive information in memory.
This vulnerability is reported as CVE-2026-8636. The attack requires a local approach. No exploit exists.
You should upgrade the affected component.
GHSA
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory.
ghsa_unreviewed·2026-06-22
CVE-2026-8636 [MEDIUM] CWE-316 IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory.
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database.
No detection rules found.
No public exploits indexed.
2026-06-22
Published