IBM Urbancode Deploy vulnerabilities

66 CVEs affecting IBM Urbancode Deploy, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-10569, published 2026-07-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-8938, published 2017-02-01. Critical severity, CVSS 10.0. EPSS: 2.8% chance of exploitation in the next 30 days. IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be executed on the UCD agent machines that host…
CVE-2017-1749, published 2018-08-13. Medium severity, CVSS 5.3. EPSS: 2.4% chance of exploitation in the next 30 days. IBM UrbanCode Deploy 6.1 through 6.9.6.0 could allow a remote attacker to traverse directories on the system. An unauthenticated attacker could alter UCD deployments. IBM X-Force ID: 135522.
CVE-2020-4481, published 2020-08-05. High severity, CVSS 8.2. EPSS: 2% chance of exploitation in the next 30 days. IBM UrbanCode Deploy (UCD) 6.2.7.3, 6.2.7.4, 7.0.3.0, and 7.0.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this…
CVE-2017-1752, published 2018-05-25. Medium severity, CVSS 4.9. EPSS: 1.6% chance of exploitation in the next 30 days. IBM UrbanCode Deploy 6.1 and 6.2 could allow an authenticated privileged user to obtain highly sensitive information. IBM X-Force ID: 135547.
CVE-2017-1149, published 2017-04-25. High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days. IBM UrbanCode Deploy (UCD) 6.0, 6.1, and 6.2 is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit…
CVE-2015-4964, published 2015-10-06. Medium severity, CVSS 6.0. EPSS: 1.5% chance of exploitation in the next 30 days. IBM UrbanCode Deploy 6.0 and 6.0.1.x before 6.0.1.10, 6.1.1.x before 6.1.1.8, and 6.1.2 writes admin AUTH_TOKEN values to execution logs, which allows remote authenticated users to gain privileges by…
CVE-2016-6068, published 2017-02-01. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties.
CVE-2017-1286, published 2018-08-13. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. Sensitive information about the configuration of the IBM UrbanCode Deploy 6.1 through 6.9.6.0 server and database can be obtained by a user who has been given elevated permissions in the UI, even…
CVE-2016-0365, published 2016-07-01. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1, when agent-relay Codestation artifact caching is enabled, allows remote attackers to bypass authentication…
CVE-2014-6074, published 2014-09-10. Medium severity, CVSS 4.0. EPSS: 1.1% chance of exploitation in the next 30 days. IBM UrbanCode Deploy 6.1.0.2 before IF1 allows remote authenticated users to read keystore secret keys via a direct request to a UI page.

Latest

CVE-2026-10569, published 2026-07-30. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an…
CVE-2026-12086, published 2026-06-30. Medium severity, CVSS 5.5. EPSS: 0.1% chance of exploitation in the next 30 days. IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy…
CVE-2026-12085, published 2026-06-30. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive…
CVE-2025-36360, published 2025-12-15. Medium severity, CVSS 5.0. EPSS: 0.2% chance of exploitation in the next 30 days. IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8.1 through 8.1.2.3 is susceptible to a…
CVE-2025-1998, published 2025-03-27. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM UrbanCode Deploy (UCD) through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 stores potentially sensitive authentication…
CVE-2025-1997, published 2025-03-27. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 is vulnerable to…
CVE-2024-56469, published 2025-03-27. Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.22, 7.2 through 7.2.3.15, and 7.3 through 7.3.2.10 / IBM DevOps Deploy 8.0 through 8.0.1.5 and 8.1 through 8.1.0.1 could allow unauthorized access to…
CVE-2024-55904, published 2025-02-14. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 / IBM UrbanCode Deploy 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.9 could allow a remote…
CVE-2024-54176, published 2025-02-08. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM DevOps Deploy 8.0 through 8.0.1.4, 8.1 through 8.1.0.0 and IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.25, 7.1 through 7.1.2.21, 7.2 through 7.2.3.14 and 7.3 through 7.3.2 could allow an…
CVE-2024-45091, published 2025-01-21. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensitive information in log files that could be read by a local user with access to…