CVE-2015-5018: IBM Security Access Manager 9.0 Firmware

High severity, CVSS 8.0. EPSS: 2.7% chance of exploitation in the next 30 days.

IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute arbitrary OS commands by leveraging Local Management Interface (LMI) access.

Affected products

• IBM Security Access Manager 9.0 Firmware: version 9.0.0 only
• IBM Security Access Manager For Web 7.0 Firmware: version 7.0.0.1 only; version 7.0.0.2 only; version 7.0.0.3 only; version 7.0.0.4 only; version 7.0.0.5 only; version 7.0.0.6 only; …
• IBM Security Access Manager For Web 8.0 Firmware: version 8.0.0.1 only; version 8.0.0.2 only; version 8.0.0.3 only; version 8.0.0.5 only; version 8.0.1 only; version 8.0.1.0 only; …

Published 2016-01-02. Last modified 2026-06-17.